# AI use cases for Security Audit Skill (cloudflare/security-audit-skill) Repo: [cloudflare/security-audit-skill](https://github.com/cloudflare/security-audit-skill) | Use cases: 4 | Page: https://dedupedai.com/use-cases/cloudflare-security-audit-skill/ A coding-agent skill that runs multi-phase security audits on a codebase and writes machine-readable, independently verified findings. This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL. - Run a full six-phase security audit of a codebase: https://dedupedai.com/use-cases/cloudflare-security-audit-skill/full-audit-of-own-codebase/ - Check one directory for security vulnerabilities: https://dedupedai.com/use-cases/cloudflare-security-audit-skill/focused-vulnerability-check-of-a-module/ - Re-audit a repo to cover only changed code: https://dedupedai.com/use-cases/cloudflare-security-audit-skill/rerun-audit-after-code-changes/ - Check audit records against the schema and ledger rules: https://dedupedai.com/use-cases/cloudflare-security-audit-skill/validate-audit-records-before-sharing/ ## How to run a full six-phase security audit of a codebase with Security Audit Skill Repo: [cloudflare/security-audit-skill](https://github.com/cloudflare/security-audit-skill) | Difficulty: Intermediate | Time: 1 hour | Basis: From the README Have your coding agent map, hunt, validate, and report on a repo in one structured run. **Who it is for:** A developer or security lead who owns a repository and wants a thorough audit before a release or after a major change. **The problem:** Ad hoc code review misses coverage gaps and produces findings with no evidence trail. **The outcome:** A set of reports and machine-readable records (REPORT.md, FINDINGS-DETAIL.md, NEEDS-VALIDATION.md, findings.json, coverage-ledger.json) that show what was checked and why each finding was kept. ### Steps 1. Install the skill with `npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit` (inferred, check the README) 2. Start your coding agent in the codebase you want to audit. 3. Ask the agent: `do a security review, output to ~/audits/my-project` 4. Let the workflow run through reconnaissance, coverage-led hunting, candidate validation, structured output, record verification, and reporting. 5. Open REPORT.md first, then check confirmed findings in findings.json and the open items in NEEDS-VALIDATION.md. ### Prompt to paste into your agent ```text Using the security-audit skill from github.com/cloudflare/security-audit-skill, run a full audit of with output to . Confirm that findings.json and coverage-ledger.json were written and validated. Verify that every confirmed record has a complete source trace. ``` ### Caveat A full audit runs many isolated agents, so expect a long run, and target code is only executed when an OS-enforced sandbox is in place. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/cloudflare-security-audit-skill/full-audit-of-own-codebase/ ## How to check one directory for security vulnerabilities with Security Audit Skill Repo: [cloudflare/security-audit-skill](https://github.com/cloudflare/security-audit-skill) | Difficulty: Beginner | Time: 15 minutes | Basis: From the README Point the agent at a single path for a quick security read without report artifacts. **Who it is for:** A developer reviewing a pull request or a single module who has a specific security question. **The problem:** A full audit is too heavy for a question about one part of the code. **The outcome:** Focused guidance on likely vulnerabilities in the chosen path, without the full set of audit output files. ### Steps 1. Install the skill with `npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit` (inferred, check the README) 2. Start your coding agent in the repository. 3. Ask the agent: `find security vulnerabilities in ./src` 4. Review the guidance the agent returns and ask follow-up questions on any item you want to test. ### Prompt to paste into your agent ```text Using the security-audit skill from github.com/cloudflare/security-audit-skill, find security vulnerabilities in . Expect guidance mode, not full audit artifacts. Verify that each point cites a specific file or function from the path. ``` ### Caveat The README describes this mode as guidance, so do not treat its output as a complete audit or as proof that a path is safe. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/cloudflare-security-audit-skill/focused-vulnerability-check-of-a-module/ ## How to re-audit a repo to cover only changed code with Security Audit Skill Repo: [cloudflare/security-audit-skill](https://github.com/cloudflare/security-audit-skill) | Difficulty: Intermediate | Time: 1 hour | Basis: From the README Reuse prior ledgers and findings so a second audit targets gaps and changed source. **Who it is for:** A security owner whose repository has changed since the last audit and who wants current coverage without starting from zero. **The problem:** Re-running an audit from scratch repeats work, while skipping it leaves new code unreviewed. **The outcome:** An updated findings and coverage set where changed source is revalidated and stale or unresolved work is not counted as covered. ### Steps 1. Keep the output directory from the earlier run, such as ~/audits/my-project. 2. Start your coding agent in the repository after the changes are merged. 3. Ask the agent: `do a security review, output to ~/audits/my-project` 4. Check the new coverage-ledger.json for units marked as changed or unresolved. 5. Compare the new findings.json with the earlier one to see what is new, confirmed again, or rejected. ### Prompt to paste into your agent ```text Using the security-audit skill from github.com/cloudflare/security-audit-skill, rerun the audit of into the existing . Report the count of confirmed, needs_validation, and rejected records. Verify that no unresolved unit is marked as covered in coverage-ledger.json. ``` ### Caveat The README says repeated runs improve coverage, and a single run found about half of what repeated runs found in its tests, so one rerun is not a guarantee of completeness. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/cloudflare-security-audit-skill/rerun-audit-after-code-changes/ ## How to check audit records against the schema and ledger rules with Security Audit Skill Repo: [cloudflare/security-audit-skill](https://github.com/cloudflare/security-audit-skill) | Difficulty: Advanced | Time: 30 minutes | Basis: From the README Run the bundled validators on findings and coverage files before you share results. **Who it is for:** A security team lead or CI owner who receives audit output from an agent and must confirm it meets the expected structure. **The problem:** Structured audit output can be malformed or incomplete, and reports built on it are unreliable. **The outcome:** Confirmation that findings.json matches report-schema.json and coverage-ledger.json passes its validator, so the records are safe to share. ### Steps 1. Clone or download the repository at github.com/cloudflare/security-audit-skill. 2. Run `node validate-findings.cjs` against your findings.json, following the script's usage message. (inferred, check the README) 3. Run `node validate-coverage-ledger.cjs` against your coverage-ledger.json. (inferred, check the README) 4. Fix any reported errors and rerun both validators until they pass. 5. Share only the validated records with reviewers. ### Prompt to paste into your agent ```text Using the validators in github.com/cloudflare/security-audit-skill, check /findings.json against report-schema.json and /coverage-ledger.json. Report any validation errors. Verify that the validators exit cleanly before the records are shared. ``` ### Caveat The README names the validator files but does not show their command-line usage, so confirm the invocation from each script before relying on it. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/cloudflare-security-audit-skill/validate-audit-records-before-sharing/