security-audit skill
A code security audit skill by Cloudflare: the agent runs recon, coverage-led hunting and independent verification of findings, then produces a structured repor
- 70,581 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Reads project source and runs target builds, tests and fixtures in a sandbox
- Spawns isolated sub-agents and writes audit artifacts to disk
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/security-auditDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Reads project source and runs target builds, tests and fixtures in a sandbox
- Spawns isolated sub-agents and writes audit artifacts to disk
This is third-party code. Review the repository files before installing.
What it does
The skill turns a coding agent into a security auditor and runs the review in six phases: recon of architecture and trust boundaries, coverage-led hunting by isolated sub-agents, validation of each candidate by a separate verifier, structured output to findings.json, independent re-verification of source claims and a target-neutral report. A finding is marked confirmed only with a complete source trace and an observed result, otherwise it stays needs_validation with no severity. The agent that checks a finding is never the one that found it. Executing target code is allowed only inside a sandbox with no external network and resource limits, and without such a sandbox the lead stays unverified. It has a focused guidance mode and a full audit mode, and repeated runs add coverage and account for prior ledgers.
Who it is for. For developers, DevOps and security engineers who need a reproducible code audit with an evidence trail.
Good fit when
- You need a full security audit of a repository or a code pen-test with a report
- You want findings checked with independent re-verification and source traces
- You want to rerun and extend coverage on top of prior results
Not a fit when
- You have no sandbox with no network and resource limits to run target code
- You need to test live environments and external services rather than source and local fixtures
Example request
Run a security audit of this repository and write the report to a separate folder outside the projectLimitations
It needs an agent whose model supports tool use and parallel sub-agents, and Node.js for the validators. Running target builds, tests and fixtures is allowed only in a sandbox with no network, a clean environment and resource limits; without it a finding stays needs_validation. The skill works with source and local fixtures, does not touch live environments and does not modify project code, it only describes fixes. A single run is not exhaustive: the authors note that several runs find noticeably more.
How to disable. Remove the security-audit skill from the agent's skills directory where npx skills add placed it, or uninstall it with the same tool.
FAQ
How does guidance mode differ from a full audit?
By default it is guidance mode for focused questions and reviews. All six phases with written artifacts run only when you explicitly ask for an audit, pen-test or report.
Does the skill change code?
No. It finds vulnerabilities and proposes the smallest source fix, but it does not modify the project code itself.
How is Cloudflare's security-audit skill different from an ordinary security review?
It runs the audit in six phases: architecture and trust boundary recon, a coverage log hunt by isolated sub-agents, independent validation of every finding and a structured report. Findings are not accepted without validation.
How do I install Cloudflare's security-audit skill?
npx skills add https://github.com/cloudflare/security-audit-skill installs the skill into Claude Code, Cursor and Codex. It is Cloudflare's skill, from the company's official repository.
Discussion
No questions or reviews yet.
Related
SkillsCybersecurity Skills
Cybersecurity Skills for AI Agents
42 security skills for Claude Code, Cursor and Codex: code and cloud audits, authorization-gated pentesting and incident response
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
A Claude Code skill that finds vulnerabilities in one session: threat model, verified findings, CWE and CVSS report.
Security audit skill with GOST and FSTEC
Security Audit Skill for Claude Code
A security audit skill for Claude Code: OWASP Top 10 plus GOST R 56939, FSTEC Order No. 21 and 152-FZ, parallel subagents and a compliance matrix
VibeSec
VibeSec-Skill
A secure coding skill: the agent looks at code from a bug hunter's perspective and prevents common web vulnerabilities
Security and 152-FZ audit skill with rouble risk pricing
axioma-security
A skill for a deep website security and 152-FZ compliance audit: every finding is mapped to a law article and priced in roubles
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| security-audit (this card) | no | 70,581 | |
| Vibe Security | no | 1,231 | a skill that audits vibe-coded apps |
| Mantis | yes | 2,762 | 19 Google skills to find |
| vbsec: security scan for AI-written code | no | 329 | a skill for Claude Code and Codex that finds common vulnerabilities |
README in short
The README describes a skill that turns a coding agent into a security auditor and runs a six-phase review with isolated sub-agents and independent validation of findings. It is the starting version of the harness that grew into Cloudflare's vulnerability discovery system. The skill installs via npx skills add and needs a sandbox with no network, a clean environment and resource limits to run target code. Verdicts differ: confirmed with a full source trace and result, needs_validation with an exact unresolved fact and no severity, and rejected for a disproved candidate. MIT licensed.
README badge
Original SKILL.md
--- name: security-audit description: Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts. --- # Security Audit Find vulnerabilities that violate a real trust boundary, then give owners the source evidence, safe reproduction, priority, and smallest effective fix. This is a defensive, source-first workflow. A candidate without a concrete affected principal, resource, or security outcome is not a confirmed finding. ## Operating modes This skill is guidance by default. Loading it does not authorize the complete audit workflow or file creation. - **Guidance mode**: For security questions, focused reviews, methodology, triage, or investigation of specific findings, use only the relevant parts of this skill. Do not automatically run all six phases, create an output directory, or write audit artifacts. You may launch focused agents when useful; they return results to the current task. - **Full audit mode**: Use the complete workflow when the user explicitly asks to audit or pen-test a codebase, asks for a full, comprehensive, or end-to-end security review, or requests report artifacts. Run all six phases and write the files defined below.