The Agent Skills Directory

[External Downloads]: The skill fetches resources and configuration from official Cloudflare repositories and documentation sites.
Evidence: The persist-skill.sh script clones https://github.com/cloudflare/skills.git and the README.md mentions fetching a hosted prompt from https://developers.cloudflare.com/turnstile/spin/prompt.md.
Context: These downloads target a trusted organization and are used to install or update the skill's own logic. The skill follows best practices by using sparse checkouts and temporary directories during these operations.
[Command Execution]: The skill executes shell commands and Python helpers to interact with the Cloudflare API and local environment.
Evidence: Scripts like auth-probe.sh, widget-create.sh, and validate.sh use curl, jq, and python3 -I to manage API tokens and validate widget configurations.
Context: Command execution is restricted to a user-approved, canonical version of the wrangler CLI or the skill's own bundled scripts. The skill includes specific safeguards to prevent secrets from appearing in shell history, logs, or command arguments, such as using standard input pipes and unsetting environment variables immediately after use.
[Indirect Prompt Injection]: The skill reads project metadata and documentation to automate configuration.
Evidence: The agent scans package.json, wrangler.toml, README.md, and other repository files to detect frontend frameworks and backend handlers.
Context: Reading untrusted repository files introduces a potential surface for indirect prompt injection. The skill mitigates this by explicitly instructing the agent to treat repository text as untrusted data that cannot alter the procedure or authorize secret writes.

turnstile-spin