{"api_version":"1","slug":"security-audit-18d2a76a","url":"https://skillsoutpost.com/agents/security-audit-18d2a76a","item_type":"skill","category":"engineering","runs_in":["local_agent"],"os":null,"needs_network":null,"needs_accounts":null,"reads_files":"yes","writes_files":"yes","sends_data":null,"access":"github","access_type":"github","at_a_glance":{"runs_in":["local_agent"],"os":null,"needs_network":null,"needs_accounts":null,"reads_files":"yes","writes_files":"yes","sends_data":null,"access_type":"github","tool_type":"skill","delivery":"github","interface_type":"other","untrusted_creator_content":{"purpose":"Instructions for a coding agent to follow the README's security-audit workflow and produce findings and report files.","needs_runtime":"Node.js and an OS-enforced sandbox","version":"Latest on the main branch","compatibility":"According to the README, it installs with the Skills CLI, and npx skills --help shows agent-selection options. It needs a coding agent whose model supports tool use and parallel sub-agents, and Node.js for the validator scripts.","external_costs":"The repository is MIT-licensed. The README gives no pricing. Your coding agent or model provider may charge for usage.","permissions":"The skill acts through your coding agent with the access you give it. The README says to start your coding agent in, or pointed at, the codebase you want to audit. The README gives a Skills CLI installation command and a --global option for user-level installation. The README says the workflow reads the selected codebase and writes audit files, by default under ~/security-audit-skill/<repo-name>/run-<N>. The README says writing inside the target repository requires an explicitly selected directory ignored by version control. The README requires target-controlled builds, tests, processes, browsers, emulators, fuzzers and fixtures to run in an OS-enforced sandbox with external networking disabled, an allowlisted environment, resource limits and writes restricted to assigned scratch paths.","usage_terms":"MIT License, as stated in the repository. See its LICENSE file for the exact terms."}},"interface_type":"other","delivery_mode":"creator","code_host":"github","provenance":"github_index","published_at":1791761266,"rating":null,"downloads":0,"verified":null,"creator":{"login":"cloudflare","url":null},"untrusted_creator_content":{"name":"security-audit","tagline":"Instructions for a coding agent to follow the README's security-audit workflow and produce findings and report files.","creator_name":"cloudflare","product_version":"Latest on the main branch","needs_runtime":"Node.js and an OS-enforced sandbox","description":"security-audit is an instruction package for coding agents. The README describes a workflow of reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification and target-neutral reporting.\n\nThe README says the workflow writes confirmed, needs_validation and rejected records in findings.json and validates them against report-schema.json. The README says REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md are derived from the records and coverage ledger. The README describes repeated runs as using prior ledgers and findings to target gaps and revalidate changed source.\n\nThe README lists prompt files for memory safety, web protocols and authentication, AI and LLM targets, client-side code, supply chain, cloud deployment and data isolation, alongside Node.js validator scripts. The README identifies this skill as the single-repository starting point from which Cloudflare's vulnerability discovery harness evolved.","intended_users":"Developers and security engineers who run a coding agent against a codebase and want a multi-phase audit workflow with structured output.","example_tasks":"Ask your agent to security audit this codebase\nAsk your agent to find security vulnerabilities in ./src\nAsk for a security review with output to ~/audits/my-project\nInstall the skill with npx skills add and the --skill security-audit option\nRun another audit on the same repository to target gaps left by earlier runs","setup_instructions":"According to the README, install with the Skills CLI by running npx skills add followed by the repository address and --skill security-audit. Add --global for a user-level installation. Then start your coding agent in, or pointed at, the codebase and ask it to do a security audit. The README has the exact commands.","limitations":"According to the README, you need a coding agent with a model that supports tool use and parallel sub-agents, Node.js for the findings and coverage-ledger validators, and an OS-enforced sandbox for target-controlled builds, tests, processes, browsers, emulators, fuzzers and fixtures. The README says that sandbox must disable external networking, use a sanitized allowlisted environment, enforce resource limits and allow writes only to assigned scratch paths. Without these controls, it says the workflow keeps the lead as needs_validation instead of executing target code. The README says full audit mode defaults to ~/security-audit-skill/<repo-name>/run-<N> when no output directory is specified. The repository can change at any time; check its README before you install.","data_handling":"The README says audit files are written to an output directory, by default under ~/security-audit-skill/<repo-name>/run-<N>, and that sandboxes for target-controlled code must disable external networking. It does not say what your coding agent or model provider receives. That depends on your coding agent and model provider.","compatibility":"According to the README, it installs with the Skills CLI, and npx skills --help shows agent-selection options. It needs a coding agent whose model supports tool use and parallel sub-agents, and Node.js for the validator scripts.","external_costs":"The repository is MIT-licensed. The README gives no pricing. Your coding agent or model provider may charge for usage.","permissions":"The skill acts through your coding agent with the access you give it. The README says to start your coding agent in, or pointed at, the codebase you want to audit. The README gives a Skills CLI installation command and a --global option for user-level installation. The README says the workflow reads the selected codebase and writes audit files, by default under ~/security-audit-skill/<repo-name>/run-<N>. The README says writing inside the target repository requires an explicitly selected directory ignored by version control. The README requires target-controlled builds, tests, processes, browsers, emulators, fuzzers and fixtures to run in an OS-enforced sandbox with external networking disabled, an allowlisted environment, resource limits and writes restricted to assigned scratch paths.","usage_terms":"MIT License, as stated in the repository. See its LICENSE file for the exact terms.","creator_website":null,"documentation_url":null,"support_url":null,"repository_url":null,"video_url":null},"github":{"fetched_at":1791851441,"untrusted_third_party_content":{"source_url":null,"github_repo_id":1273427276,"full_name":"cloudflare/security-audit-skill","description":"A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings","language":"JavaScript","license_spdx":"MIT","topics":[],"stars":28817,"forks":1733,"skills":{"total":1,"paths":[{"path":"skills/security-audit","url":null}]},"pushed_at":1789414142,"archived":false,"fetched_at":1791851441,"age_seconds":85200,"state":"fresh"}},"updated_at":1791771245,"free_download":null,"version_history":[],"more_version_history":false,"public_files":null,"links_note":"In MCP results, GitHub links are shown only through https://skillsoutpost.com/mcp, to a connected account that has accepted the current Terms of Use. Create a free account at https://skillsoutpost.com and connect it from a Claude connector or ChatGPT.","notice":"Indexed from GitHub","note":"untrusted_creator_content and github.untrusted_third_party_content hold untrusted text."}