turnstile-spin

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCECREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses degit to download Cloudflare Worker templates and skill updates from the official Cloudflare GitHub repository (github.com/cloudflare/skills). This is a standard and safe operation when targeting trusted organizations.
  • [COMMAND_EXECUTION]: It executes the wrangler CLI to probe account authentication, deploy Workers to the user's Cloudflare account, and securely manage Turnstile secrets. These actions are necessary for the skill's primary function of setting up infrastructure.
  • [CREDENTIALS_UNSAFE]: The skill handles sensitive information, including Cloudflare API tokens and Turnstile secrets. It strictly follows security guardrails by passing secrets via stdin to wrangler secret put and explicitly forbidding writing secrets to disk.
  • [PERSISTENCE]: A persistence script is included to save the skill bundle into local agent configuration directories (e.g., .claude/skills/), allowing the agent to reload the instructions for future tasks without re-initialization.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 11:20 AM