--- title: "Cloudflare Turnstile Spin: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/cloudflare-turnstile-spin/ description: "Integrate a Turnstile widget with an existing frontend and server-side Siteverify, including secret-safe helpers and replay validation." --- # Cloudflare Turnstile Spin: review, setup & limitations · Undominated.ai > Integrate a Turnstile widget with an existing frontend and server-side Siteverify, including secret-safe helpers and replay validation. [← Explore all skills](/skills/) SECURITY / Cloudflare # Cloudflare Turnstile Spin Integrate a Turnstile widget with an existing frontend and server-side Siteverify, including secret-safe helpers and replay validation. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/cloudflare/skills/tree/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin) SOURCE REVIEW Reviewed 2026-10-15 Evidence 6 linked sources Publisher Cloudflare Licence [Apache-2.0 ↗](https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/LICENSE) Revision 53395984c3ea [Read what was—and wasn’t—checked ↓](#review) “Set up, repair, or migrate to Cloudflare Turnstile bot verification in an existing frontend and backend, including server-side Siteverify.” [Cloudflare · upstream description ↗](https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - It wires Cloudflare Turnstile into an existing frontend and backend, with server-side siteverify and a token that is not pasted into chat. - Helper scripts call api.cloudflare.com, and the skill refuses a browser-side siteverify call or extra Worker infrastructure. - Covers both existing-widget and widget-creation paths and framework-specific integrations. - Checks success, expected action and deployment-specific hostname before existing backend logic proceeds. ### A good fit for - Adding Turnstile to a form that already has a server-side handler - Repairing an existing widget without creating a replacement sitekey - Replace an existing CAPTCHA in a signup or contact flow. - Repair a Turnstile frontend that lacks server-side verification or replay checks. ### Weigh up before choosing - A pure-static site with no backend is out of scope, because siteverify needs a server. - The API token and widget secret must not be printed or pasted into chat. - The skill does not migrate email delivery, add a new backend, or restyle the frontend. - This review did not execute the resource. - The metadata/dummy-token helper does not establish end-to-end protection; a real backend success and replay rejection remain necessary. - The persistence helper clones the current upstream branch; use the pinned bundle when reproducing this review. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - skills/turnstile-spin/SKILL.md - skills/turnstile-spin/scripts/validate.sh - skills/turnstile-spin/scripts/persist-skill.sh - README.md - LICENSE ### Our findings - Helper scripts use curl against api.cloudflare.com, and account enumeration needs an account id or an approved Wrangler binary. - The procedure says not to ask the user to paste the API token into chat, and to store the widget secret without printing it. - Siteverify is called from the existing backend, not from the browser, and no extra Worker is deployed. - If the form has no backend handler, the skill says to exit rather than invent one. - validate.sh reads the widget secret from stdin, compares widget metadata and sends a deliberately invalid Siteverify token. - persist-skill.sh refuses a nonempty/out-of-project target but fetches unpinned upstream HEAD. ### Not established by this review - The resource was not executed and its tools were not called. - No skill execution, authenticated service operation, or outcome benchmark was performed. - Not executed: it was not installed or run. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/vercel-labs/skills/blob/13e4063a1cf913f5606d57d42ab83a86f5001e04/README.md) DOCUMENTED COMMAND npx skills add cloudflare/skills/skills/turnstile-spin --skill turnstile-spin Copy command ↗ Run in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above. Optional: install the reviewed revision Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose. npx skills add https://github.com/cloudflare/skills/tree/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin --skill turnstile-spin Copy reviewed-revision command ↗ - Install the complete skill directory with its references, scripts, and tests; a copied SKILL.md alone is incomplete. - Choose your AI tools and project or global scope in the installer, then review its permissions before using the skill. ### Before you start - Node.js/npm for this installer - An agent that supports the Agent Skills format - A Cloudflare account with Turnstile sitekey, secret, and account ID for validation ### Compatibility Agent Skills-compatible coding agents · Astro, Hugo, Next.js app and pages routers, SvelteKit, vanilla HTML ### Local instructions; runtime access depends on the workflow - Creates or reads account widgets and writes frontend/backend source plus the selected secret store. - Helpers handle API/widget secrets; never expose their complete API responses in logs. ### Cost model The skill is free; service usage and infrastructure can incur charges. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Pinned skill definition ↗](https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin/SKILL.md) Checked 2026-10-14 https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin/SKILL.md Supports: summary, whySelected, bestFor, limitations, install, access, review - [Publisher repository and installation guidance ↗](https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/README.md) Checked 2026-10-14 https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/README.md Supports: install - [Apache-2.0 licence ↗](https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/LICENSE) Checked 2026-10-14 https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/LICENSE Supports: license - [skills/turnstile-spin/scripts/validate.sh ↗](https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin/scripts/validate.sh) Checked 2026-10-14 https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin/scripts/validate.sh Supports: review, limitations, access, install - [skills/turnstile-spin/scripts/persist-skill.sh ↗](https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin/scripts/persist-skill.sh) Checked 2026-10-14 https://github.com/cloudflare/skills/blob/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin/scripts/persist-skill.sh Supports: review, limitations, access, install - [2026-10-15 W48 source re-review at the existing pin ↗](https://raw.githubusercontent.com/cloudflare/skills/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin/SKILL.md) Checked 2026-10-15 https://raw.githubusercontent.com/cloudflare/skills/53395984c3ea1925d00fce03b266112302f050e6/skills/turnstile-spin/SKILL.md Supports: upstreamDescription, review.notTested, review.reviewedAt KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Burp Project Parser ↗ Extract and search captured Burp traffic while distinguishing empty results from parser startup failures.](/skills/trailofbits-burpsuite-project-parser/)[### C and C++ Security Review ↗ Coordinate scoped native C/C++ security review and assemble findings with an explicit coverage ledger.](/skills/trailofbits-c-review/)[### Dependabot ↗ Configures and manages Dependabot end to end: ecosystem detection across 25+ package managers, monorepo glob directories, grouped and multi-ecosystem updates, cooldown periods, ignore and allow rules, and PR command etiquette including the January 2026 deprecations.](/skills/github-dependabot/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)