The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches its canonical bundle from Cloudflare's official GitHub repository and documentation site. These operations target well-known, trusted vendor infrastructure.
[COMMAND_EXECUTION]: The skill utilizes system utilities such as curl, git, and python3 to perform its tasks. It also supports execution of the Cloudflare wrangler CLI, but only when provided with a user-approved, canonical, and absolute path located outside the project root to prevent malicious binary hijacking.
[CREDENTIALS_UNSAFE]: While the skill manages high-entropy secrets like Cloudflare API tokens and Turnstile secrets, it employs robust mitigation strategies: using subshells with set +x to prevent logging, unsetting variables immediately after use, and instructing the agent to read secrets via silent input methods to avoid leakage in chat history.
[INDIRECT_PROMPT_INJECTION]: The skill ingests codebase metadata (e.g., package.json, README.md) to detect frameworks, but the instructions explicitly define this data as untrusted and prohibit it from altering the execution flow or authorizing secret operations.
[DYNAMIC_EXECUTION]: The helper scripts generate and execute transient Python code blocks for specialized tasks like canonicalizing paths and parsing JSON. These operations are performed using the isolated -I flag and stay within the scope of the skill's utility functions.

turnstile-spin