turnstile-spin
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCECREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
degitto download Cloudflare Worker templates and skill updates from the official Cloudflare GitHub repository (github.com/cloudflare/skills). This is a standard and safe operation when targeting trusted organizations. - [COMMAND_EXECUTION]: It executes the
wranglerCLI to probe account authentication, deploy Workers to the user's Cloudflare account, and securely manage Turnstile secrets. These actions are necessary for the skill's primary function of setting up infrastructure. - [CREDENTIALS_UNSAFE]: The skill handles sensitive information, including Cloudflare API tokens and Turnstile secrets. It strictly follows security guardrails by passing secrets via stdin to
wrangler secret putand explicitly forbidding writing secrets to disk. - [PERSISTENCE]: A persistence script is included to save the skill bundle into local agent configuration directories (e.g.,
.claude/skills/), allowing the agent to reload the instructions for future tasks without re-initialization.
Audit Metadata