DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to run a full six-phase security audit of a codebase with Security Audit Skill

Have your coding agent map, hunt, validate, and report on a repo in one structured run.

Authorization notice. Security Audit Skill is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Who it is forA developer or security lead who owns a repository and wants a thorough audit before a release or after a major change.

The problemAd hoc code review misses coverage gaps and produces findings with no evidence trail.

The outcomeA set of reports and machine-readable records (REPORT.md, FINDINGS-DETAIL.md, NEEDS-VALIDATION.md, findings.json, coverage-ledger.json) that show what was checked and why each finding was kept.

What you need first

  • A coding agent with a model that supports tool use and parallel sub-agents
  • Node.js, for the zero-dependency findings and coverage-ledger validators
  • An OS-enforced sandbox if the audit must run target-controlled builds, tests, or fixtures; without it, the workflow keeps leads as needs_validation instead of executing target code
  • The skill installed with the Skills CLI (npx skills add)

Steps

  1. Install the skill with npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit (inferred, check the README)
  2. Start your coding agent in the codebase you want to audit.
  3. Ask the agent: do a security review, output to ~/audits/my-project
  4. Let the workflow run through reconnaissance, coverage-led hunting, candidate validation, structured output, record verification, and reporting.
  5. Open REPORT.md first, then check confirmed findings in findings.json and the open items in NEEDS-VALIDATION.md.

Prompt for your agent

Using the security-audit skill from github.com/cloudflare/security-audit-skill, run a full audit of <target-repo-path> with output to <output-dir>. Confirm that findings.json and coverage-ledger.json were written and validated. Verify that every confirmed record has a complete source trace.

Caveat. A full audit runs many isolated agents, so expect a long run, and target code is only executed when an OS-enforced sandbox is in place.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page