SPF DKIM Setup
v1.0.0Manage DNS records via the Cloudflare API. Create, list, update, and delete DNS records (A, AAAA, CNAME, TXT, MX, SPF, DKIM). Use when the agent needs to add...
⭐ 0· 412·0 current·0 all-time
byMasas Dani@masasdani
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The SKILL.md describes Cloudflare DNS management (create/list/update/delete records) which matches the skill name and description — that capability is coherent. However, the skill's runtime instructions require CLOUDFLARE_API_TOKEN and CLOUDFLARE_ZONE_ID, but the registry metadata lists no required environment variables or primary credential. That mismatch is unexpected and should be corrected.
Instruction Scope
Instructions are narrowly scoped to Cloudflare DNS API calls and email-auth record handling (SPF/DKIM/DMARC) and do not request unrelated system files or credentials. They reference a Mailtarget integration workflow which could require additional credentials (not declared). Examples use curl and jq but the metadata does not declare required binaries; relying on tools not declared may lead to runtime surprises.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is downloaded or written to disk by the skill itself. That reduces installer risk.
Credentials
The SKILL.md explicitly requires CLOUDFLARE_API_TOKEN (DNS Write) and CLOUDFLARE_ZONE_ID but the registry metadata lists zero required env vars/credentials. Requesting a token with DNS Write permission is proportional to the stated function, but the omission from metadata is a serious coherence/visibility issue. Additionally, the documented Mailtarget integration implies other credentials may be needed but none are declared.
Persistence & Privilege
The skill is not always-included and does not request elevated persistence. It is user-invocable and allows standard autonomous invocation (platform default). There is no instruction to modify other skills or system-wide settings.
What to consider before installing
Before installing, verify and fix the metadata mismatch: the SKILL.md requires CLOUDFLARE_API_TOKEN (with DNS Write scope) and CLOUDFLARE_ZONE_ID but the registry lists no required env vars. Only provide a Cloudflare token scoped to the specific zone and minimum permissions (prefer zone-scoped or limited API token rather than global account keys). Be aware examples use curl and jq — ensure those tools exist or adapt commands. If you plan to enable autonomous use, consider restricting the token to a non-production/test zone first to confirm behavior. Ask the publisher to (1) update the registry metadata to declare the required env vars/primary credential, (2) document exactly what Mailtarget credentials (if any) are needed for the Mailtarget integration, and (3) explain why jq/curl are assumed available. If the publisher cannot justify or correct these discrepancies, do not install or provide sensitive credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk977zyyd7hc8ker03km5hj01jx81pbqe
License
MIT-0
Free to use, modify, and redistribute. No attribution required.