turnstile-spin
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Script-Driven Automation: The skill utilizes several shell scripts located in the
scripts/directory to automate Cloudflare API interactions. These includeauth-probe.shfor verifying credentials andwidget-create.shfor resource provisioning. - Network Operations to Cloudflare Infrastructure: The scripts perform network requests to
api.cloudflare.comandchallenges.cloudflare.com. These operations are essential for communicating with the Cloudflare API and validating Turnstile siteverify integrations. - External Utility Usage: The skill uses
npx wranglerfor account enumeration andnpx degitto fetch skill updates from the official Cloudflare repository on GitHub. These are well-known developer tools used for Cloudflare project management. - Sensitive Data Handling: The skill manages
CLOUDFLARE_API_TOKENandTURNSTILE_SECRET. It includes specific instructions to avoid logging these secrets or storing them in plain text, directing the agent to use environment variables or dedicated secret managers instead. - Persistence Mechanism: The
persist-skill.shscript installs the skill bundle into the user's project directory (e.g.,.claude/skills/). This is a standard feature for persisting agent capabilities across sessions.
Audit Metadata