What you can do with Security Audit Skill

4 use cases

• Run a full six-phase security audit of a codebase

  Have your coding agent map, hunt, validate, and report on a repo in one structured run.

  • Security Audit Skill
  • Security and science
  • Intermediate
  View prompt

  Using the security-audit skill from github.com/cloudflare/security-audit-skill, run a full audit of <target-repo-path> with output to <output-dir>. Confirm that findings.json and coverage-ledger.json were written and validated. Verify that every confirmed record has a complete source trace.

  Share Save

• Check one directory for security vulnerabilities

  Point the agent at a single path for a quick security read without report artifacts.

  • Security Audit Skill
  • Security and science
  • Beginner
  View prompt

  Using the security-audit skill from github.com/cloudflare/security-audit-skill, find security vulnerabilities in <path-in-repo>. Expect guidance mode, not full audit artifacts. Verify that each point cites a specific file or function from the path.

  Share Save

• Re-audit a repo to cover only changed code

  Reuse prior ledgers and findings so a second audit targets gaps and changed source.

  • Security Audit Skill
  • Security and science
  • Intermediate
  View prompt

  Using the security-audit skill from github.com/cloudflare/security-audit-skill, rerun the audit of <target-repo-path> into the existing <output-dir>. Report the count of confirmed, needs_validation, and rejected records. Verify that no unresolved unit is marked as covered in coverage-ledger.json.

  Share Save

• Check audit records against the schema and ledger rules

  Run the bundled validators on findings and coverage files before you share results.

  • Security Audit Skill
  • Security and science
  • Advanced
  View prompt

  Using the validators in github.com/cloudflare/security-audit-skill, check <output-dir>/findings.json against report-schema.json and <output-dir>/coverage-ledger.json. Report any validation errors. Verify that the validators exit cleanly before the records are shared.

  Share Save

How to use Security Audit Skill

1. Check you have what it needs: A coding agent with a model that supports tool use and parallel sub-agents; Node.js, for the zero-dependency findings and coverage-ledger validators; An OS-enforced sandbox if the audit must run target-controlled builds, tests, or fixtures; without it, the workflow keeps leads as needs_validation instead of executing target code.
2. Open cloudflare/security-audit-skill on GitHub and read the README and license.
3. Install the skill with npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit (inferred, check the README)
4. Start your coding agent in the codebase you want to audit.
5. Ask the agent: do a security review, output to ~/audits/my-project
6. Let the workflow run through reconnaissance, coverage-led hunting, candidate validation, structured output, record verification, and reporting.

These steps come from our top use case, Run a full six-phase security audit of a codebase, which also has a copy-paste agent prompt.

Security Audit Skill alternatives · Best AI repos for Security and science

About this repo

• Who it is forSecurity engineers and developers who want a coding agent to run a structured audit of code they own or are authorized to test.
• Why it is hot
• LanguageJavaScript
• Sourcegithub.com/cloudflare/security-audit-skill · Back to Hot repos

Requirements

• A coding agent with a model that supports tool use and parallel sub-agents
• Node.js, for the zero-dependency findings and coverage-ledger validators
• An OS-enforced sandbox if the audit must run target-controlled builds, tests, or fixtures; without it, the workflow keeps leads as needs_validation instead of executing target code
• The skill installed with the Skills CLI (npx skills add)

Related repos

• Trended earlier Cosy Redact Gateway A lightweight, stateless privacy gateway that sits between your app and LLM APIs, redacting detected secrets and sensitive values before they reach OpenAI or Anthropic upstreams and restoring placeholders in responses.
• Trended earlier Reburp reburp is a Burp Suite extension that exposes the Montoya API as a local, unauthenticated REST API with OpenAPI docs and Swagger UI, so scripts and AI agents can drive Burp.
• Trended earlier Jev Guard jev-guard is a security hook for coding agents that scores each tool call with session context and returns deny, ask, or allow, flags prompt injection in tool results, and checks skills and plugins, powered by Jev.