What does this skill do, and when should you use it?
This is a focused Agent Skill from the cloudflare/skills repository for integrating Cloudflare Turnstile. It scans a codebase, identifies the frontend framework, backend handler, and any existing CAPTCHA, then creates or reuses a Turnstile widget and connects verification to the existing form flow. It requires an existing backend where siteverify can run and does not add backends, email delivery, databases, or deployment infrastructure.
Runs an authentication probe and handles Cloudflare account selection; scans package.json, wrangler.toml, README.md, AGENTS.md, and the git remote for domains; detects the frontend framework, backend handler location, and reCAPTCHA or hCaptcha; creates a widget through Wrangler or the Cloudflare API and captures its sitekey and secret; embeds Turnstile on selected forms and adds canonical server-side siteverify, allowing the existing handler to continue only when success === true; runs validation and can persist the skill to an agent-specific path.
- Developers using Next.js, Astro, SvelteKit, Hugo, or vanilla HTML who need to protect signup, login, or contact forms.
- Maintainers who already have a Cloudflare Turnstile sitekey but whose server-side siteverify integration is missing or broken.
- Teams migrating from reCAPTCHA or hCaptcha and needing coordinated frontend token and backend verification changes.
- Developers adding Turnstile verification inside an existing Cloudflare Pages Function or Workers request handler.
How do you install this skill?
- This is a static review only; no scripts, API calls, or validation were executed, so claims of a real validation pass are unproven.
- Before use, review and supply the missing scripts, key-path tests, rollback procedure, and stronger secret-storage boundaries.
- The core workflow depends on the Cloudflare API, Wrangler, npx, and external documentation; confirm reachability from mainland-China networks and prepare an offline or proxy-supported path if needed.
- Widget creation and code edits have external effects; retain explicit user confirmation before each irreversible or externally effective step.
- Shell / CLI
- Network access
- Local filesystem
curlNode.js with npxWrangler 4.109+ preferred for widget creation
The skill is located at skills/turnstile-spin/ in cloudflare/skills. Install the full collection with npx skills add https://github.com/cloudflare/skills, or clone the repository and copy this skill folder into the relevant agent directory, such as ~/.claude/skills/, ~/.codex/skills/, or ~/.cursor/skills/.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/cloudflare/skills.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/skills/turnstile-spin" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
Once installed, send your agent any of these to trigger it:
- Set up Cloudflare Turnstile for my contact form
- Fix this Turnstile integration.
In an Agent Skills-compatible agent, use a request such as “Set up Cloudflare Turnstile for my contact form” or “Fix this Turnstile integration.” The workflow asks for confirmation before scanning, registering domains, creating or modifying widgets, editing the integration, validating, and persisting the skill. A Cloudflare API token with Account.Turnstile:Edit is required; the source does not document a complete standalone manual procedure.
What are this skill's strengths and limitations?
- Covers widget creation, frontend embedding, backend siteverify, and validation as one workflow.
- Explicitly preserves the existing form handler and adds verification as a gate.
- Supports wiring an existing widget without rotating its sitekey.
- Includes migration guidance for reCAPTCHA and hCaptcha plus several recovery and edge-case paths.
- Requires an existing backend handler; pure-static and mailto-only forms are out of scope.
- Requires network access to Cloudflare APIs and Turnstile edit permissions; multi-account tokens require account selection.
- The source does not document an automated test suite or actual coverage across project templates.
- Does not handle email, database, payment, OAuth, new backend creation, or infrastructure deployment.
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| Turnstile End-to-End Setup this page | 54 · Use with care | ★ 3.1k | 12d ago | Apache-2.0 |
| Stripe Integration Best Practices | 53 · Use with care | ★ 1.9k | 13d ago | MIT |
| Cloudflare Email Service Skill | 52 · Use with care | ★ 3.1k | 12d ago | Apache-2.0 |
| Skill Install — Secure Skill Installer | 49 · Use with care | ★ 2.8k | 5mo ago | AGPL-3.0 |
| Expo EAS Hosting Deployments | 48 · Use with care | ★ 2.9k | 21d ago | MIT |
It supports migration from reCAPTCHA or hCaptcha by replacing frontend scripts, widget markup, token fields, and server-side verification endpoints. reCAPTCHA Enterprise is not auto-migrated, and reCAPTCHA v3 score thresholds have no direct equivalent; migrated validation uses success === true/false.
How did FollowSkills review this skill?
The skill requires confirmation, uses Account.Turnstile:Edit, keeps secrets out of ordinary files, forbids browser-side siteverify, and requires diffs and validation, giving the data-flow boundaries reasonable clarity. Deducted 8 points because it creates or modifies Cloudflare resources and user code without an explicit rollback procedure; credential isolation across all handoff paths is not demonstrated, and it relies on external docs and scripts.
The evidence shows a staged state machine, auth probing, Wrangler/curl fallback, abnormal-status branches, and a validation step. Deducted 13 points because the key scripts are not included in the supplied material, so widget creation, secret retrieval, and validation cannot be reproduced; no key-path test coverage is shown, and execution depends on npx, jq or Python, and network services.
Trigger terms, supported scenarios, non-fit boundaries, CAPTCHA migration behavior, and several framework examples are clearly stated. Deducted 4 points because Chinese-language interaction and mainland-China network reachability are not addressed, while the core flow depends on Cloudflare APIs, Wrangler, and overseas documentation; trigger precision is still primarily keyword-based and backend coverage is limited.
The evidence shows progressive step-by-step instructions, README layout and installation notes, references, license metadata, and a documented synchronization source. Deducted 6 points because there is no clear version, changelog, named maintenance responsibility, or stable update path; the README references tests and scripts that are absent from the supplied material, and installation/persistence assumes a particular environment.
The stated goal is an end-to-end Turnstile integration covering widget creation, frontend embedding, backend siteverify, secret configuration, and validation, with examples that are directly adaptable. Deducted 9 points because the static material contains no real execution results or representative verified outputs; users must still manually determine handlers, domains, insertion points, and platform secret management, and the examples do not cover every claimed environment.
The evidence includes canonical-looking siteverify examples, explicit auth-probe logic, a documentation synchronization claim, and repository Semgrep CI. Deducted 6 points because the key scripts, executable test suite, execution logs, and independent corroboration are not supplied, preventing end-to-end verification; the external canonical docs are asserted as authoritative but their contents are not available here.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →