Evidence record · captured 2026-10-11

Cloudflare Turnstile Setup

A scripted wizard that turns 'set up Turnstile' into a working integration: the agent runs bundled shell scripts (which return JSON) to probe API auth, create a widget, then edits the existing frontend (framework references for HTML, Next.js, Astro, Hugo, SvelteKit) and backend to add server-side Siteverify, and finally runs a real validation pass before reporting success.

Official publisherUnverifiedSource reviewedBehavior not tested

Source review

Editorial assessment

This is a source-only assessment. It does not claim runtime or security testing.

What it does

An executable wizard rather than reference text: bundled scripts create a Turnstile widget on your account, the agent gates existing handlers with Siteverify, and a real token plus replay test confirms it.

Best for

Adding bot protection to an existing signup, login, or contact form that already has a backend handler
Migrating from reCAPTCHA or hCaptcha to Turnstile
Storing a dashboard-created widget's secret without the secret passing through chat

Strengths in the source

Canonical Siteverify code fails closed and checks success, the expected action, and a per-deployment hostname allowlist excluding localhost in production.
Pauses for user confirmation at defined steps and forbids asking the user to paste API tokens or widget secrets into chat.
Runs git check-ignore on any .env file before writing a secret and refuses to proceed if the file is not ignored.
Requires a real request with a fresh token plus a replay-rejection check before reporting end-to-end success.

Limitations

Bundled scripts make authenticated, state-changing calls to the Cloudflare API: they create Turnstile widgets and write secrets to Workers.
Needs a Cloudflare API token with Account.Turnstile:Edit, plus bash, curl, python3, and jq.
persist-skill.sh clones the cloudflare/skills repo at run time and copies files into your project, so that copy may differ from this pin.

When not to use it

Static sites or mailto-only forms with no server handler; the skill says it will stop because Siteverify needs a backend.
reCAPTCHA Enterprise migrations or setups that rely on v3 score thresholds, which the skill does not auto-migrate.

Reviewed by Retenta editorial on 2026-10-11; scope: source only.

Files included in this review

skills/turnstile-spin/SKILL.md

Evidence and boundaries

Execution · not tested

Retenta has not executed this skill.

Security · not tested

Bundles 4 scripts (scripts/auth-probe.sh, scripts/widget-create.sh, scripts/validate.sh, scripts/persist-skill.sh) that the agent may run. Retenta has not run them or scanned them.

Pinned publisher source: skills/turnstile-spin/SKILL.md
Revision: c430dd965cea3a8faf0ef035e3b3d73b38518081
License evidence: Apache-2.0Retenta preserves the license text captured with this immutable upstream snapshot; no independent legal or security review is claimed.
Last source change: 2026-10-01
Independent verification: Published by Cloudflare, but not independently verified by a third-party reviewer.
Upstream repository: Open publisher repository