SECURITY / Cloudflare
Cloudflare Turnstile Spin
Integrate a Turnstile widget with an existing frontend and server-side Siteverify, including secret-safe helpers and replay validation.
“Set up, repair, or migrate to Cloudflare Turnstile bot verification in an existing frontend and backend, including server-side Siteverify.”
01 / THE REASONING
Why this made the selection.
- It wires Cloudflare Turnstile into an existing frontend and backend, with server-side siteverify and a token that is not pasted into chat.
- Helper scripts call api.cloudflare.com, and the skill refuses a browser-side siteverify call or extra Worker infrastructure.
- Covers both existing-widget and widget-creation paths and framework-specific integrations.
- Checks success, expected action and deployment-specific hostname before existing backend logic proceeds.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- skills/turnstile-spin/SKILL.md
- skills/turnstile-spin/scripts/validate.sh
- skills/turnstile-spin/scripts/persist-skill.sh
- README.md
- LICENSE
Our findings
- Helper scripts use curl against api.cloudflare.com, and account enumeration needs an account id or an approved Wrangler binary.
- The procedure says not to ask the user to paste the API token into chat, and to store the widget secret without printing it.
- Siteverify is called from the existing backend, not from the browser, and no extra Worker is deployed.
- If the form has no backend handler, the skill says to exit rather than invent one.
- validate.sh reads the widget secret from stdin, compares widget metadata and sends a deliberately invalid Siteverify token.
- persist-skill.sh refuses a nonempty/out-of-project target but fetches unpinned upstream HEAD.
Not established by this review
- The resource was not executed and its tools were not called.
- No skill execution, authenticated service operation, or outcome benchmark was performed.
- Not executed: it was not installed or run.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
npx skills add cloudflare/skills/skills/turnstile-spin --skill turnstile-spinRun in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above.
Optional: install the reviewed revision
Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose.
npx skills add https://github.com/cloudflare/skills/tree/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin --skill turnstile-spin- Install the complete skill directory with its references, scripts, and tests; a copied SKILL.md alone is incomplete.
- Choose your AI tools and project or global scope in the installer, then review its permissions before using the skill.
Before you start
- Node.js/npm for this installer
- An agent that supports the Agent Skills format
- A Cloudflare account with Turnstile sitekey, secret, and account ID for validation
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Pinned skill definition ↗Checked
https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin/SKILL.md
Supports: summary, whySelected, bestFor, limitations, install, access, review
https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/README.md
Supports: install
- Apache-2.0 licence ↗Checked
https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/LICENSE
Supports: license
https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin/scripts/validate.sh
Supports: review, limitations, access, install
https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin/scripts/persist-skill.sh
Supports: review, limitations, access, install
https://raw.githubusercontent.com/cloudflare/skills/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin/SKILL.md
Supports: upstreamDescription, review.notTested, review.reviewedAt