turnstile-spin

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The worker_deploy and persist-skill scripts call degit at runtime to fetch the cloudflare/skills repository (npx --yes degit cloudflare/skills/... which resolves to https://github.com/cloudflare/skills), pulling remote code/templates (the Worker template) that are then deployed/used locally (wrangler deploy), so external content is fetched at runtime and used to execute/deploy code.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill bundle for literal, high-entropy credentials that look like usable secrets.

Findings:

• Flagged as secrets (present as literal, high-entropy values that would be accepted by siteverify):
• 1x0000000000000000000000000000000AA (documented test secret — "always succeeds")
• Occurs in templates/worker/README.md (Cloudflare's documented test secrets table) and templates/worker/test/integration.test.ts (PASSING_SECRET).
• 2x0000000000000000000000000000000AA (documented test secret — "always fails")
• Occurs in templates/worker/README.md and templates/worker/test/integration.test.ts (FAILING_SECRET).
• 3x0000000000000000000000000000000AA (documented test secret — "already-spent token / timeout-or-duplicate")
• Occurs in templates/worker/README.md and templates/worker/test/integration.test.ts (SPENT_TOKEN_SECRET).

Rationale: These three strings are literal, non-placeholder, high-entropy values used as test secrets and are accepted by Cloudflare's siteverify endpoint (they appear in integration tests and the README as test secrets). Per the secret definition (high-entropy literal values that provide access/behavior), they qualify as secrets. Even though they are documented test secrets (publicly-known), the instruction was to identify actual, active credentials in documentation — these meet that criterion.

Ignored items (not flagged):

• Placeholder strings like YOUR_SITEKEY, YOUR_WORKER_URL, YOUR_SITEKEY, YOUR_WORKER_URL, YOUR_SITEKEY in examples — these are documentation placeholders and explicitly excluded.
• Environment variable names (e.g., CLOUDFLARE_API_TOKEN, TURNSTILE_SECRET_KEY) — names only, no value provided.
• Low-entropy example secret values like 'test-secret-key' in unit tests — clearly a test stub / low-entropy example, so ignored.
• Test sitekeys (e.g., 1x00000000000000000000AA, 2x00000000000000000000AB, etc.) — these are public sitekeys (client-side, not secret) and do not grant backend access; therefore not flagged as secrets.

Conclusion: the bundle contains the three documented test secrets listed above, which I treat as literal secrets present in the documentation and tests.