The Agent Skills Directory

Command Execution: The skill employs several local shell scripts (scripts/*.sh) to automate tasks such as account probing, widget creation, and configuration validation. These scripts are used to interact with the Cloudflare API in a deterministic manner, with measures in place to prevent command echoing of sensitive data.
External Downloads: During its setup and persistence phases, the skill may download resources from the vendor's official GitHub repository (github.com/cloudflare/skills) or their developer documentation site (developers.cloudflare.com). These references are consistent with the skill's intended deployment and maintenance flow.
Credential Handling: The skill manages sensitive information, including Cloudflare API tokens and Turnstile secrets. It incorporates multiple safeguards, such as instructing users on secure token entry (e.g., using read -rs) and ensuring that secrets are handled via standard input or environment variables rather than being exposed in chat history or command arguments.
Indirect Prompt Injection Surface: To tailor the integration, the skill scans existing project files like package.json, README.md, and backend source code. While this introduces an attack surface where untrusted data could influence agent behavior, the skill includes explicit instructions to treat repository text as untrusted and to verify values before proceeding.

turnstile-spin