How to check one directory for security vulnerabilities with Security Audit Skill

Authorization notice. Security Audit Skill is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Who it is forA developer reviewing a pull request or a single module who has a specific security question.

The problemA full audit is too heavy for a question about one part of the code.

The outcomeFocused guidance on likely vulnerabilities in the chosen path, without the full set of audit output files.

What you need first

A coding agent with a model that supports tool use and parallel sub-agents
Node.js, for the zero-dependency findings and coverage-ledger validators
An OS-enforced sandbox if the audit must run target-controlled builds, tests, or fixtures; without it, the workflow keeps leads as needs_validation instead of executing target code
The skill installed with the Skills CLI (npx skills add)

Steps

Install the skill with npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit (inferred, check the README)
Start your coding agent in the repository.
Ask the agent: find security vulnerabilities in ./src
Review the guidance the agent returns and ask follow-up questions on any item you want to test.

Prompt for your agent

Using the security-audit skill from github.com/cloudflare/security-audit-skill, find security vulnerabilities in <path-in-repo>. Expect guidance mode, not full audit artifacts. Verify that each point cites a specific file or function from the path.

Caveat. The README describes this mode as guidance, so do not treat its output as a complete audit or as proof that a path is safe.