CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

cloudflare-turnstile

This skill should be used when the user asks to "add turnstile", "implement bot protection", "validate turnstile token", "fix turnstile error", "setup captcha alternative", or encounters error codes 100*/300*/600*, CSP errors, or token validation failures. Provides CAPTCHA-alternative protection for Cloudflare Workers, React, Next.js, and Hono.

60

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/cloudflare-turnstile/skills/cloudflare-turnstile/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable content with well-organized references and strong troubleshooting coverage, undermined by significant duplication across sections and advertised template files missing from the bundle.

Suggestions

Consolidate the redundant coverage: merge Quick Start with 'The 3-Step Setup Process' and fold the 12 Known Issues into Critical Rules/Troubleshooting so token expiry, single-use, and secret-key rules are stated once, cutting roughly a third of the body.

Ship the templates/ directory or remove the references: the body's 'When to Load References' section and frontmatter (templates_included: 7) advertise 7 template files (wrangler-turnstile-config.jsonc, turnstile-hono-route.ts, etc.) that are absent from the bundle.

Fix the executable-code gaps: add the missing useState import to the React example and move the HTML <script> loader line out of the explicit-rendering TypeScript code block.

DimensionReasoningScore

Conciseness

The setup flow is presented twice (Quick Start, then 'The 3-Step Setup Process' with overlapping server-validation code), and token TTL/single-use and secret-key rules each repeat 3-4 times across Critical Rules, Known Issues, and Troubleshooting, plus padding like 'Token Efficiency: ~65-70% savings'. Mostly concrete, so above anchor 2, but needs consolidation to reach 4.

3 / 5

Actionability

Concrete copy-paste HTML/TS/TSX blocks, a Jest mock, CSP directives, and a runnable script cover the common cases, but minor gaps remain: the React example omits the useState import and the explicit-rendering TypeScript block embeds an HTML <script> tag, keeping it below fully-executable anchor 5.

4 / 5

Workflow Clarity

The Quick Start and 3-Step sections give a clear create-widget → integrate-frontend → validate-server sequence, and the Troubleshooting section provides error-recovery loops, but explicit validation checkpoints during the workflow (e.g., verify with dummy keys before deploy) are deferred to a reference rather than inline, matching anchor 4 rather than 5.

4 / 5

Progressive Disclosure

The 'When to Load References' section clearly signals 10 real one-level-deep reference files, but the body and frontmatter (templates_included: 7) point to a templates/ directory with 7 files that do not exist in the bundle — broken navigation to nearly half the advertised materials, which drops it below the 'minor organization gaps' of anchor 4.

3 / 5

Total

14

/

20

Passed

Description

77%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with explicit, natural trigger phrases and a clear Turnstile niche. Its main weakness is a generic one-line capability statement that doesn't enumerate what the skill concretely does.

DimensionReasoningScore

Specificity

The only capability statement is the generic 'Provides CAPTCHA-alternative protection for Cloudflare Workers, React, Next.js, and Hono'; concrete verbs appear solely in the user-trigger quotes ('add turnstile', 'validate turnstile token') rather than as an enumeration of the skill's own actions, matching the 'domain plus 1-2 concrete actions, not comprehensive' anchor.

3 / 5

Completeness

Both parts are present and 'when' is explicit ('This skill should be used when the user asks to...'), but the 'what' ('Provides CAPTCHA-alternative protection for...') is generic rather than concrete capabilities, so it falls short of the anchor-5 example where both are explicit and concrete. Not 3 because both what and when are clearly stated.

4 / 5

Trigger Term Quality

Natural user phrasings are comprehensive — 'add turnstile', 'implement bot protection', 'fix turnstile error', 'setup captcha alternative', 'token validation failures', plus Turnstile-specific error codes 100*/300*/600* — covering synonyms users would actually say. Not 4 because no common variation is missing.

5 / 5

Distinctiveness Conflict Risk

Turnstile-specific triggers (product name, error codes 100*/300*/600*) establish a clear niche, but 'implement bot protection' and 'captcha alternative' create minor overlap risk with closely related CAPTCHA skills (reCAPTCHA, hCaptcha). Not 5 for that overlap; not 3 since the dominant triggers are unambiguously Turnstile.

4 / 5

Total

16

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (511 lines); consider splitting into references/ and linking

Warning

metadata_field

'metadata' should map string keys to string values

Warning

Total

14

/

16

Passed

Repository

secondsky/claude-skills

Path

plugins/cloudflare-turnstile/skills/cloudflare-turnstile/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.