{ "schema_version": 1, "generated": "2026-10-23", "id": "cloudflare-security-audit-skill--rerun-audit-after-code-changes", "repo": "cloudflare/security-audit-skill", "repo_url": "https://github.com/cloudflare/security-audit-skill", "repo_slug": "cloudflare-security-audit-skill", "title": "Re-audit a repo to cover only changed code", "page_title": "How to re-audit a repo to cover only changed code with Security Audit Skill", "summary": "Reuse prior ledgers and findings so a second audit targets gaps and changed source.", "who": "A security owner whose repository has changed since the last audit and who wants current coverage without starting from zero.", "problem": "Re-running an audit from scratch repeats work, while skipping it leaves new code unreviewed.", "outcome": "An updated findings and coverage set where changed source is revalidated and stale or unresolved work is not counted as covered.", "steps": [ "Keep the output directory from the earlier run, such as ~/audits/my-project.", "Start your coding agent in the repository after the changes are merged.", "Ask the agent: `do a security review, output to ~/audits/my-project`", "Check the new coverage-ledger.json for units marked as changed or unresolved.", "Compare the new findings.json with the earlier one to see what is new, confirmed again, or rejected." ], "agent_prompt": "Using the security-audit skill from github.com/cloudflare/security-audit-skill, rerun the audit of into the existing . Report the count of confirmed, needs_validation, and rejected records. Verify that no unresolved unit is marked as covered in coverage-ledger.json.", "agents": [ "any" ], "difficulty": "Intermediate", "time": "1 hour", "basis": "readme", "caveat": "The README says repeated runs improve coverage, and a single run found about half of what repeated runs found in its tests, so one rerun is not a guarantee of completeness.", "category": "Security and science", "tags": [ "Security and science" ], "lang": "javascript", "requirements": [ "A coding agent with a model that supports tool use and parallel sub-agents", "Node.js, for the zero-dependency findings and coverage-ledger validators", "An OS-enforced sandbox if the audit must run target-controlled builds, tests, or fixtures; without it, the workflow keeps leads as needs_validation instead of executing target code", "The skill installed with the Skills CLI (npx skills add)" ], "risk": "dual-use", "seen_in_the_wild": false, "mentioned_publicly": false, "risks": [], "best": false, "score": 0.8, "evidence": [], "url": "https://dedupedai.com/use-cases/cloudflare-security-audit-skill/rerun-audit-after-code-changes/", "md": "https://dedupedai.com/use-cases/cloudflare-security-audit-skill/rerun-audit-after-code-changes/index.md", "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.", "api": "https://dedupedai.com/api/v1/usecases/cloudflare-security-audit-skill--rerun-audit-after-code-changes.json", "api_version": "v1" }