turnstile-spin

Pass

Audited by Gen Agent Trust Hub on Jul 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • Script-Driven Automation: The skill utilizes several shell scripts located in the scripts/ directory to automate Cloudflare API interactions. These include auth-probe.sh for verifying credentials and widget-create.sh for resource provisioning.
  • Network Operations to Cloudflare Infrastructure: The scripts perform network requests to api.cloudflare.com and challenges.cloudflare.com. These operations are essential for communicating with the Cloudflare API and validating Turnstile siteverify integrations.
  • External Utility Usage: The skill uses npx wrangler for account enumeration and npx degit to fetch skill updates from the official Cloudflare repository on GitHub. These are well-known developer tools used for Cloudflare project management.
  • Sensitive Data Handling: The skill manages CLOUDFLARE_API_TOKEN and TURNSTILE_SECRET. It includes specific instructions to avoid logging these secrets or storing them in plain text, directing the agent to use environment variables or dedicated secret managers instead.
  • Persistence Mechanism: The persist-skill.sh script installs the skill bundle into the user's project directory (e.g., .claude/skills/). This is a standard feature for persisting agent capabilities across sessions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 25, 2026, 05:17 PM
Security Audit — agent-trust-hub — turnstile-spin