engineering / skill
security-audit
Instructions for a coding agent to follow the README's security-audit workflow and produce findings and report files.
At a glance
- Purpose
- Instructions for a coding agent to follow the README's security-audit workflow and produce findings and report files.
- Runs in
- Local agent with shell
- Operating systems
- Not stated
- Needs
- Runtime: Node.js and an OS-enforced sandbox; Needs internet: Not stated; Needs accounts or API keys beyond your agent: Not stated
- Files and data
- Reads files: Yes; Writes files: Yes; Sends data to other services: Not stated
- Tool type
- Skill
- Delivery
- From GitHub
- Version
- Latest on the main branch
- Access
- Code on GitHub
- Compatibility
- According to the README, it installs with the Skills CLI, and npx skills --help shows agent-selection options. It needs a coding agent whose model supports tool use and parallel sub-agents, and Node.js for the validator scripts.
- External costs
- The repository is MIT-licensed. The README gives no pricing. Your coding agent or model provider may charge for usage.
- Permissions
- The skill acts through your coding agent with the access you give it. The README says to start your coding agent in, or pointed at, the codebase you want to audit. The README gives a Skills CLI installation command and a --global option for user-level installation. The README says the workflow reads the selected codebase and writes audit files, by default under ~/security-audit-skill/<repo-name>/run-<N>. The README says writing inside the target repository requires an explicitly selected directory ignored by version control. The README requires target-controlled builds, tests, processes, browsers, emulators, fuzzers and fixtures to run in an OS-enforced sandbox with external networking disabled, an allowlisted environment, resource limits and writes restricted to assigned scratch paths.
- Usage terms
- MIT License, as stated in the repository. See its LICENSE file for the exact terms.
Code on GitHub
cloudflare/security-audit-skill
MITA coding-agent skill for multi-phase security audits with independently verified, machine-readable findings
Public GitHub data fetched · 0 days old
Skill folders in this repository (1)
Folders that contain a SKILL.md file, from GitHub's file list on .
What it does
security-audit is an instruction package for coding agents. The README describes a workflow of reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification and target-neutral reporting.The README says the workflow writes confirmed, needs_validation and rejected records in findings.json and validates them against report-schema.json. The README says REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md are derived from the records and coverage ledger. The README describes repeated runs as using prior ledgers and findings to target gaps and revalidate changed source.
The README lists prompt files for memory safety, web protocols and authentication, AI and LLM targets, client-side code, supply chain, cloud deployment and data isolation, alongside Node.js validator scripts. The README identifies this skill as the single-repository starting point from which Cloudflare's vulnerability discovery harness evolved.
Who it is for
Developers and security engineers who run a coding agent against a codebase and want a multi-phase audit workflow with structured output.Example tasks
Ask your agent to security audit this codebaseAsk your agent to find security vulnerabilities in ./src
Ask for a security review with output to ~/audits/my-project
Install the skill with npx skills add and the --skill security-audit option
Run another audit on the same repository to target gaps left by earlier runs