security-auditcommit c1c8a8cSKILL.md · Security Audit
Security Audit
Defensive, source-first security review that finds vulnerabilities crossing a real trust boundary, with evidence, safe reproduction, priority and fix.
npx skills add cloudflare/security-audit-skill --skill security-auditCommand selected. Copy it manually.
- Permissions
- read-repo
- write-files
- shell
- network
- Compatible with
- Any SKILL.md agent
- GitHub
- 55.7k
- Source
- Official · Cloudflare
- Status
- Scan passed
- License
- MIT
- Category
- Security Audit
Core rule
A candidate without a concrete affected principal, resource or security outcome is not a confirmed finding.
Execution Phases
Phase 01Pick mode and set up
Guidance is the default; in full audit mode, create an output directory outside the target and write run-metadata.json.
Phase 02Reconnaissance
Map the source, trust boundaries, local build paths and prior runs, and build a deterministic coverage ledger.
Phase 03Coverage-led hunting
Assign isolated hunters from the ledger, run coverage-critic waves to find gaps, and collect structured candidates.
Phase 04Independent validation
Fresh verifiers that did not hunt try to refute each candidate; results go to findings.json and are checked with the schema and validators.
Phase 05Write the report
After independent verification of the final records, derive REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md.
Permissions (summarised from SKILL.md)
| Capability | Needed | Details |
|---|---|---|
| File writes | Limited | Writes audit files only in full audit mode, to an output directory outside the target; never modifies target source. |
| Command execution | Limited | Target code runs only in an OS-enforced sandbox with no external network, read-only source and resource limits; bundled validators also run. |
| Network outbound | Not required | Does not probe deployed endpoints or external services, and installs no dependencies. |
SKILL.md frontmatter (YAML)
---
name: security-audit
description: Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.
---