Pi/Claude skill: Cloudflare internal services via cloudflared access curl

cloudflare-internal-services-skill.md

Cloudflare Internal Services

Use this skill when a user asks to access, inspect, curl, query, automate, or debug a Cloudflare internal service protected by Cloudflare Access.

This is especially relevant for internal URLs such as:

• https://jira.cfdata.org/...
• https://wiki.cfdata.org/... or other Confluence/wiki hosts
• Any host ending in .cfdata.org
• Any internal Cloudflare service that redirects through Cloudflare Access

Core rule

Use cloudflared access curl instead of plain curl for Cloudflare Access-protected internal services.

Correct:

cloudflared access curl 'https://host.cfdata.org/path' -sS

Incorrect:

cloudflared access curl -sS 'https://host.cfdata.org/path'

The URL must come immediately after cloudflared access curl; regular curl flags such as -sS, -X, -H, and --data come after the URL.

Authentication flow

If the user is not already authenticated, cloudflared may open a browser window or print a Cloudflare Access login URL.

Ask the user to complete browser auth, then retry the command.

Prefer APIs over HTML scraping

For Jira, Confluence/wiki, dashboards, and other internal tools, prefer documented or discoverable REST APIs over scraping HTML pages.

Useful examples:

cloudflared access curl 'https://jira.cfdata.org/rest/api/2/myself' -sS

cloudflared access curl 'https://jira.cfdata.org/rest/api/2/issue/PROJECT-123?fields=summary,status,assignee,description' -sS

cloudflared access curl 'https://jira.cfdata.org/rest/agile/1.0/board/BOARD_ID' -sS

cloudflared access curl 'https://jira.cfdata.org/rest/agile/1.0/board/BOARD_ID/issue?maxResults=100&fields=summary,status,assignee,issuetype,priority,updated,created' -sS

Pretty-print JSON:

cloudflared access curl 'https://jira.cfdata.org/rest/api/2/issue/PROJECT-123' -sS | python3 -m json.tool

Jira actions

Create issue:

cat > /tmp/create-issue.json <<'JSON'
{
  "fields": {
    "project": { "key": "PROJECT" },
    "summary": "Issue summary",
    "description": "Issue description",
    "issuetype": { "name": "Task" }
  }
}
JSON

cloudflared access curl 'https://jira.cfdata.org/rest/api/2/issue' \
  -sS -X POST -H 'Content-Type: application/json' \
  --data @/tmp/create-issue.json

List available transitions:

cloudflared access curl 'https://jira.cfdata.org/rest/api/2/issue/PROJECT-123/transitions' -sS

Transition issue, for example after discovering the transition ID:

cloudflared access curl 'https://jira.cfdata.org/rest/api/2/issue/PROJECT-123/transitions' \
  -sS -X POST -H 'Content-Type: application/json' \
  --data '{"transition":{"id":"31"}}'

Update issue fields:

cloudflared access curl 'https://jira.cfdata.org/rest/api/2/issue/PROJECT-123' \
  -sS -X PUT -H 'Content-Type: application/json' \
  --data '{"fields":{"summary":"New summary"}}'

Delete issue, if permissions allow:

cloudflared access curl 'https://jira.cfdata.org/rest/api/2/issue/PROJECT-123' -sS -X DELETE

If deletion fails with permission errors, offer to move the issue to Done/Canceled/Archived or mark it clearly in the summary/labels.

Confluence / wiki notes

For Confluence-like internal wiki services, look for REST endpoints before scraping pages. Common patterns include:

cloudflared access curl 'https://wiki.cfdata.org/rest/api/content?title=Page%20Title&expand=body.storage,version,space' -sS

cloudflared access curl 'https://wiki.cfdata.org/rest/api/content/CONTENT_ID?expand=body.storage,version,space' -sS

The exact hostname and API shape may vary. If unsure, first fetch a small endpoint or inspect links from the page, always through cloudflared access curl.

Handling JSON safely

Prefer writing request bodies to /tmp/*.json and using --data @file rather than complex shell quoting.

Example:

python3 - <<'PY' >/tmp/payload.json
import json
print(json.dumps({"fields": {"summary": "Example"}}))
PY

cloudflared access curl 'https://jira.cfdata.org/rest/api/2/issue/PROJECT-123' \
  -sS -X PUT -H 'Content-Type: application/json' \
  --data @/tmp/payload.json

Security and data handling

• Do not paste Cloudflare Access tokens, cookies, or credentials into chat.
• Avoid saving sensitive internal data into repositories or long-lived files unless explicitly requested.
• Use /tmp for transient JSON payloads and API responses.
• Summarize internal data concisely.
• Prefer the minimum fields needed for the task.

Troubleshooting

If a request returns HTML, redirects, or auth errors:

1. Confirm the URL is passed immediately after cloudflared access curl.
2. Retry after the user completes browser auth.
3. Check whether the endpoint requires a REST API path rather than a browser page.
4. Try a simpler endpoint first, such as Jira myself or board metadata.