スキル turnstile-spin
📦
turnstile-spin
コンテンツリビジョン r1 高リスク 🌐 ネットワークアクセス📁 ファイルシステムへのアクセス🔑 環境変数⚡ スクリプトを含む⚙️ 外部コマンド
Add Cloudflare Turnstile Protection
Bot protection often fails when frontend widgets and server checks are configured separately. This skill coordinates creation, integration, secret handling, and validation.
対応: Claude Codex Code(CC)
インストール前に停止して確認を求めてください。
計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "turnstile-spin" from https://skillstore.io/skills/cloudflare-turnstile-spin.md and its manifest at https://skillstore.io/api/skills/cloudflare-turnstile-spin/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「turnstile-spin」を使用しています。 Protect the signup form in this Next.js application from automated submissions.
期待される結果:
- Detected a Next.js App Router signup page and its server route.
- Created one managed widget for the approved domains.
- Added server validation for success, signup action, and approved hostnames.
- Validation passed for the widget configuration and failed safely for a replayed token.
「turnstile-spin」を使用しています。 Our contact form has a Turnstile widget, but submissions still bypass it.
期待される結果:
- The browser widget was present, but the server handler did not call Siteverify.
- Added Siteverify before the existing contact logic and preserved the original handler.
- Validation remains pending because the backend could not run locally.
セキュリティ監査
高リスクv1 • 2026/8/9 バージョン別レポートを開く
Most static alerts are safe Turnstile examples, bounded shell operations, or false matches on Markdown. Confirmed issues include plaintext home-directory token storage and mutable remote skill installation without integrity verification. The remote installation path can introduce unaudited instructions and executable scripts.
13
スキャンされたファイル
2,117
解析済み行数
6
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (1)
高
Unpinned Remote Skill Installation
Installation paths fetch mutable remote skill content without a commit pin or digest. The persistence script copies fetched shell scripts and makes them executable.
The clone and download commands omit immutable revisions and integrity verification. The fetched bundle is installed into an agent skill directory with executable scripts.
機能レビュー項目 (6)
これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。
高
Hardcoded URL
git clone https://github.com/cloudflare/skills ~/.config/cloudflare-skills
The installation command clones a mutable default branch and places it behind an agent skill symlink. Future unaudited repository content can become trusted instructions.
高
Hardcoded URL
curl -sSL https://developers.cloudflare.com/turnstile/spin/prompt.md \
The fallback downloads a mutable remote prompt directly into an agent skill path without a pinned revision or integrity check. Compromise or upstream changes would alter trusted instructions.
高
Hardcoded URL
"https://github.com/cloudflare/skills.git" \
The persistence script clones the mutable cloudflare/skills repository without selecting an audited commit. It then installs that remote bundle as executable agent instructions.
高
Python shutil operations
shutil.copytree(source, target, dirs_exist_ok=False)
copytree installs files from the unpinned remote clone and marks included shell scripts executable. Path checks limit the destination but do not establish source integrity.
高
Hidden file in home directory
2. **Save to file** (token in a user-only file): `umask 077; read -rsp 'Cloudflare API token: ' toke
The workflow offers to store a Cloudflare API token as plaintext in ~/.cf-turnstile-token. Restrictive permissions reduce exposure but do not provide encrypted credential storage.
高
Hidden file access
2. **Save to file** (token in a user-only file): `umask 077; read -rsp 'Cloudflare API token: ' toke
The hidden file contains a long-lived Cloudflare API token and is later loaded for authentication. This creates a persistent plaintext credential outside a managed secret store.
リスク要因
🌐 ネットワークアクセス (50)
README.md:29 README.md:37 references/astro.md:60 references/astro.md:108 references/astro.md:13 references/astro.md:60 references/astro.md:108 references/astro.md:171 references/hugo.md:58 references/hugo.md:7 references/hugo.md:58 references/nextjs-app.md:46 references/nextjs-app.md:103 references/nextjs-app.md:155 references/nextjs-app.md:67 references/nextjs-app.md:103 references/nextjs-app.md:155 references/nextjs-app.md:237 references/nextjs-pages.md:52 references/nextjs-pages.md:11 references/nextjs-pages.md:52 references/sveltekit.md:82 references/sveltekit.md:137 references/sveltekit.md:168 references/sveltekit.md:30 references/sveltekit.md:82 references/sveltekit.md:137 references/vanilla-html.md:46 references/vanilla-html.md:120 references/vanilla-html.md:85 references/vanilla-html.md:74 references/vanilla-html.md:77 references/vanilla-html.md:10 references/vanilla-html.md:46 references/vanilla-html.md:74 references/vanilla-html.md:85 references/vanilla-html.md:137 scripts/auth-probe.sh:180 scripts/auth-probe.sh:241 scripts/persist-skill.sh:67 scripts/validate.sh:84 scripts/validate.sh:118 scripts/widget-create.sh:67 SKILL.md:95 SKILL.md:19 SKILL.md:46 SKILL.md:95 SKILL.md:253 SKILL.md:287 SKILL.md:305
📁 ファイルシステムへのアクセス (25)
README.md:29 README.md:30 README.md:29 README.md:30 README.md:30 scripts/auth-probe.sh:33 scripts/auth-probe.sh:78 scripts/auth-probe.sh:86 scripts/auth-probe.sh:240 scripts/persist-skill.sh:35 scripts/persist-skill.sh:62 scripts/persist-skill.sh:73 scripts/persist-skill.sh:55 scripts/persist-skill.sh:96 scripts/validate.sh:54 scripts/validate.sh:64 scripts/validate.sh:98 scripts/validate.sh:131 scripts/widget-create.sh:45 SKILL.md:327 SKILL.md:48 SKILL.md:48 SKILL.md:232 SKILL.md:262 SKILL.md:272
🔑 環境変数 (28)
references/nextjs-app.md:89 references/nextjs-app.md:107 references/nextjs-app.md:140 references/nextjs-app.md:159 references/nextjs-app.md:89 references/nextjs-app.md:107 references/nextjs-app.md:140 references/nextjs-app.md:159 references/nextjs-pages.md:34 references/nextjs-pages.md:56 references/nextjs-pages.md:34 references/nextjs-pages.md:56 references/vanilla-html.md:38 references/vanilla-html.md:50 references/vanilla-html.md:38 references/vanilla-html.md:50 references/vanilla-html.md:82 references/vanilla-html.md:86 scripts/persist-skill.sh:10 scripts/persist-skill.sh:7 scripts/validate.sh:71 scripts/validate.sh:103 scripts/validate.sh:107 scripts/validate.sh:111 SKILL.md:83 SKILL.md:100 SKILL.md:83 SKILL.md:100
⚡ スクリプトを含む (2)
⚙️ 外部コマンド (50)
scripts/auth-probe.sh:10 scripts/auth-probe.sh:19 scripts/auth-probe.sh:60 scripts/auth-probe.sh:66 scripts/auth-probe.sh:77-79 scripts/auth-probe.sh:86 scripts/auth-probe.sh:87 scripts/auth-probe.sh:88-91 scripts/auth-probe.sh:96-99 scripts/auth-probe.sh:108 scripts/auth-probe.sh:118-122 scripts/auth-probe.sh:129-133 scripts/auth-probe.sh:141-144 scripts/auth-probe.sh:154-157 scripts/auth-probe.sh:175 scripts/auth-probe.sh:177-183 scripts/auth-probe.sh:190-196 scripts/auth-probe.sh:237 scripts/auth-probe.sh:238-242 scripts/auth-probe.sh:251-255 scripts/auth-probe.sh:263-267 scripts/auth-probe.sh:275-279 scripts/persist-skill.sh:28 scripts/persist-skill.sh:42 scripts/persist-skill.sh:43 scripts/persist-skill.sh:55 scripts/validate.sh:78 scripts/validate.sh:79 scripts/validate.sh:81-85 scripts/validate.sh:103 scripts/validate.sh:114-116 scripts/widget-create.sh:51-54 scripts/widget-create.sh:62 scripts/widget-create.sh:64-70 SKILL.md:17 SKILL.md:42 SKILL.md:44 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:53 SKILL.md:55 SKILL.md:57 SKILL.md:64 SKILL.md:66
監査者: codex
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/cloudflare-turnstile-spin/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/cloudflare-turnstile-spin?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/cloudflare-turnstile-spin?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cloudflare-turnstile-spin/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/cloudflare-turnstile-spin.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
cloudflare. (2026). turnstile-spin security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cloudflare-turnstile-spin/audits/1BibTeX形式の引用
@techreport{cloudflare-cloudflare-turnstile-spin-2026,
author = {cloudflare},
title = {turnstile-spin security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/cloudflare-turnstile-spin/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "turnstile-spin security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "cloudflare"
date-released: "2026-08-09"
url: "https://skillstore.io/skills/cloudflare-turnstile-spin/audits/1"
identifiers:
- type: other
value: "skillstore:cloudflare-turnstile-spin:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 82
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
83
仕様準拠
作成できるもの
Protect a signup flow
Add a widget to signup and reject automated requests in the existing server handler.
Migrate an existing CAPTCHA
Replace reCAPTCHA or hCaptcha with Turnstile while preserving actions and backend behavior.
Repair a partial integration
Find missing hostname, action, secret, reset, or Siteverify checks and validate the corrected flow.
これらのプロンプトを試す
Protect one form
Add Cloudflare Turnstile to the signup form and its existing backend handler. Ask before creating resources or writing secrets.
Protect selected actions
Scan this project for user-triggered requests. Recommend which actions need Turnstile, then integrate only the actions I approve.
Migrate another CAPTCHA
Migrate the existing reCAPTCHA or hCaptcha integration to Turnstile. Preserve valid action names and existing business logic.
Audit and repair Turnstile
Audit this Turnstile integration end to end. Verify secret handling, expected actions, hostname allowlists, widget resets, and replay rejection before making approved fixes.
ベストプラクティス
- Use separate production hostname allowlists and exclude loopback addresses from production.
- Keep the secret in an ignored environment file or managed secret store.
- Validate success, action, hostname, and replay behavior before reporting completion.
回避
- Do not call Siteverify from browser code or expose the secret to the client.
- Do not run credential-bearing commands through project-local package executables.
- Do not replace existing business logic when adding the verification gate.
よくある質問
Does this skill create a Turnstile widget?
Yes. It can create a managed widget after account, domain, and user confirmation.
Can it use an existing widget?
Yes. It supports guarded retrieval, validation, and storage for an existing widget.
Which frameworks are documented?
The bundle includes examples for Next.js, Astro, SvelteKit, Hugo, and vanilla HTML backends.
Does it work for a static site without a backend?
No. Secure Turnstile validation requires an existing server-side handler.
Where is the Turnstile secret stored?
It uses an approved ignored environment file or the existing platform secret manager.
What does validation cover?
It checks widget metadata, secret ownership, domains, actions, hostnames, successful requests, and token replay rejection.