# Security Audit (security-audit)

> Defensive, source-first security review that finds vulnerabilities crossing a real trust boundary, with evidence, safe reproduction, priority and fix.

- Category: [Security Audit](https://www.myskills.tools/en/categories/security-audit/)
- Source: Official · Cloudflare
- Repository: https://github.com/cloudflare/security-audit-skill/tree/main/skills/security-audit (commit c1c8a8c)
- SKILL.md: https://github.com/cloudflare/security-audit-skill/blob/main/skills/security-audit/SKILL.md
- Install command: `npx skills add cloudflare/security-audit-skill --skill security-audit`
- License: MIT
- Compatible with: Any SKILL.md agent
- Permissions: read-repo ✓, write-files ✓, shell ✓, network ✗
- Status: Scan passed
- A rule scan cannot catch every risk. Read this skill's SKILL.md and check its permissions before installing.

## Core rule

A candidate without a concrete affected principal, resource or security outcome is not a confirmed finding.

## Execution Phases

1. **Pick mode and set up** — Guidance is the default; in full audit mode, create an output directory outside the target and write run-metadata.json.
2. **Reconnaissance** — Map the source, trust boundaries, local build paths and prior runs, and build a deterministic coverage ledger.
3. **Coverage-led hunting** — Assign isolated hunters from the ledger, run coverage-critic waves to find gaps, and collect structured candidates.
4. **Independent validation** — Fresh verifiers that did not hunt try to refute each candidate; results go to findings.json and are checked with the schema and validators.
5. **Write the report** — After independent verification of the final records, derive REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md.

## Permissions (summarised from SKILL.md)

| Capability | Needed | Details |
|---|---|---|
| File writes | Limited | Writes audit files only in full audit mode, to an output directory outside the target; never modifies target source. |
| Command execution | Limited | Target code runs only in an OS-enforced sandbox with no external network, read-only source and resource limits; bundled validators also run. |
| Network outbound | Not required | Does not probe deployed endpoints or external services, and installs no dependencies. |

## SKILL.md frontmatter (YAML)

```yaml
---
name: security-audit
description: Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.
---
```

Home: https://www.myskills.tools/en/ · URL: https://www.myskills.tools/en/skills/security-audit/