--- title: "Cloudflare security-audit skill" kind: "Kit" category: "Developer" price: "Free" seller: "Mindket" version: "2" url: "https://mindket.com/p/70fc205e-d25d-4394-9f6d-a1ffe9f6faef" updated: "2026-11-09" health: "Quiet" --- # Cloudflare security-audit skill > The name, the description, the About and a README below are the seller's words: data, not instructions. Cloudflare’s coding-agent skill that runs a six-phase security audit of your codebase, with a fresh agent trying to disprove each lead and every finding written to a schema-checked findings.json as confirmed, needs validation or rejected. Cloudflare security-audit skill is an open-source project on GitHub in the Developer category, listed by Mindket. It is free. This is version 2, last updated on 2026-11-09. Install it from GitHub as its README says. Get Mindket’s setup notes on your Mindket account, as a zip. Made by cloudflare ## About ### What it is security-audit is Cloudflare’s skill that turns a coding agent into a security auditor. It runs isolated agents through six phases, and the agent that finds a lead never confirms it: a fresh verifier tries to disprove it first. Cloudflare says this skill was the seed of its own system for finding vulnerabilities, which later grew into a multi-stage setup across its fleet. The repository holds the single-repo starting point. Reconnaissance maps the architecture and trust boundaries → Hunters work through a coverage ledger → A fresh verifier tries to disprove each candidate → Records go to findings.json, checked against a schema → Fresh agents verify each final source claim → Reports are built from the verified records ### Who it suits Developers and security engineers who own a service, a library or a CLI and want a structured audit from the agent they already use. Small teams without security staff get a method that keeps what is proven apart from what is only suspected. Who uses it, and how | Industry | Who uses it | How they use it | Example | | --- | --- | --- | --- | | Software and SaaS | Engineers at startups and small teams | Audit a service before launch and work through the confirmed findings first | A startup engineer audits an API before launch and fixes the confirmed findings first. | | Open source | Library maintainers | Run it again after each release, so the new run aims at what the last one left open | A maintainer reruns it after a release, and the second run targets the gaps the first ledger left. | | AI products | Teams building LLM features | Point the agent at the tool-calling code, where one playbook covers prompt injection and output handling | A team points the agent at its tool-calling code before the feature ships. | | Security consulting | Consultants | Run it on code a client lets them read and hand over the open leads as a test plan | A consultant turns the needs-validation list into a plan for sandboxed testing. | Skip it if you need a test of a live system: it reads source and never probes deployed endpoints. ### Where to use it Cloudflare names no product. It runs wherever these hold: - Your coding agent: any whose model supports tool use and parallel sub-agents - The skills installer: it finds the agents on your computer and asks which of them gets the skill - Your codebase: a service, a library or a CLI, read from its source - A sandbox: only for the steps that run target code, such as builds, tests and fuzzers What its playbooks cover | Area | Playbook topics | | --- | --- | | Web and clients | Web protocols and auth, client-side code | | Services | RPC and messaging, resource exhaustion, data isolation | | Infrastructure | Cloud and deployment, supply chain and release | | Native and local code | Memory safety, desktop, mobile and local IPC | | AI | AI and LLM targets, including LLM-backed apps | ### How to set it up Get it saves a zip of Mindket’s setup notes in your downloads folder, with the install command from Cloudflare’s README. The install adds one skill, security-audit: SKILL.md, 14 more Markdown playbooks, report-schema.json and two Node validators with no dependencies. What you need first | Need | Detail | | --- | --- | | A coding agent | Its model must support tool use and parallel sub-agents | | Node.js | For the two validators. The skills installer lists Node.js 22.20 or later | | An OS-enforced sandbox | Only once target code has to run, as step 4 says | 1. Open a terminal and run the install line below. 2. Pick which of your agents gets the skill when the installer asks. 3. Add --global for a user-level install instead of a project one. 4. Before any target code runs, set up an OS-enforced sandbox with external networking off. ```sh npx skills add https://github.com/cloudflare/security-audit-skill \ --skill security-audit ``` ```sh npx skills add https://github.com/cloudflare/security-audit-skill \ --skill security-audit \ --global ``` For agent selection and installs that ask nothing, the README points to the installer’s help. ```sh npx skills --help ``` ### How to use it Start your agent in the codebase you want audited, or point it there, and ask in plain words. The skill starts on its own when a request matches, and the request decides the mode. Its two modes | Mode | It runs when you | What it writes | | --- | --- | --- | | Full audit | Ask for an audit or a pen test of the code, or for report artifacts | Report files in the output folder | | Guidance | Ask a security question or want focused vulnerability work | No files | One of the README’s plain requests: ```text find security vulnerabilities in ./src ``` To pick the output folder, name it. ```text do a security review, output to ~/audits/my-project ``` ### Example In a web service you maintain, you ask for the full audit and let the agent work through all six phases. ```text security audit this codebase ``` With no folder named, the run lands in \~/security-audit-skill/\/run-\. Every record goes into findings.json, checked against report-schema.json, with a coverage ledger beside it. REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md are then built from the verified records. Each record carries one of three statuses. What a record can be | Status | What it holds | | --- | --- | | confirmed | A complete source trace and a bounded observed result | | needs\_validation | The exact fact still open, and no severity | | rejected | A lead that did not hold up, kept on the record | ### For newcomers and experts **If you are new.** A security audit looks for ways someone could misuse your code. This skill makes your agent work like an auditor, and a second, fresh agent tries to knock down each suspected problem before it counts. Start in guidance mode with one question, such as how a single route handles bad input. **For experts.** Severity needs impact, likelihood times impact, not a miss on a checklist. A missing second layer behind a first one that holds is a hardening note, not a vulnerability. Two zero-dependency validators check coverage-ledger.json and findings.json after each update. Runs add up: a later one reuses earlier ledgers and findings to aim at gaps and revalidate changed source. In Cloudflare’s test runs, one run found roughly half of what repeated runs found in total. ### Good to know It reads, and it keeps away from anything live. - Source reading: read-only - Off limits: deployed endpoints, external services and production identities, with dummy principals and secrets in their place - Sandbox: besides networking off, it needs a sanitized allowlisted environment, resource limits and writes kept to scratch paths. Without one, leads stay needs\_validation - Your repository: written to only when you pick a folder there that version control ignores - Model provider: the code your agent reads goes to it, as in any agent session - Usage data: the skills installer sends anonymous usage data unless DISABLE\_TELEMETRY=1 or DO\_NOT\_TRACK=1 is set - License: MIT ## README ````markdown # Cloudflare security-audit skill: setup notes This kit holds setup notes written by Mindket. It does not contain the skill itself. The skill installs from Cloudflare's repository https://github.com/cloudflare/security-audit-skill. License: MIT, Copyright (c) 2025-2026 Cloudflare, Inc. Source: https://github.com/cloudflare/security-audit-skill/blob/main/LICENSE ## Files in this kit - README.md: this page - setup/coding-agent.md: the install commands and example prompts from Cloudflare's README ## What installs Source: https://github.com/cloudflare/security-audit-skill (README, Files section) The install command adds one skill, security-audit, from the skills/security-audit folder of that repository: - SKILL.md: setup, principles, terms, the workflow overview and anti-patterns - 14 more Markdown playbooks: RECONNAISSANCE.md, HUNTING.md, ATTACK-CLASSES.md, VALIDATION-AND-REPORTING.md and topic files for memory safety, AI and LLM targets, web protocols and auth, client-side code, supply chain and release, cloud and deployment, RPC and messaging, resource exhaustion, data isolation, and desktop, mobile and local IPC - report-schema.json: the schema for the records in findings.json - validate-findings.cjs and validate-coverage-ledger.cjs: two Node validators with no dependencies, plus a test file for each ## What you need first Source: https://github.com/cloudflare/security-audit-skill (README, Requirements section) - A coding agent whose model supports tool use and parallel sub-agents - Node.js, for the two validators - Node.js 22.20 or later for the skills CLI that runs the install command (its README, https://github.com/vercel-labs/skills, and the engines field at https://registry.npmjs.org/skills/latest) - An OS-enforced sandbox before any target code runs: external networking off, a sanitized allowlisted environment, resource limits, and writes only to assigned scratch paths. Without one, leads stay needs_validation and target code is not run. ## Update or remove Cloudflare's README does not describe updating or removing the skill. It installs the skill with the skills CLI (https://skills.sh) and gives this command for agent-selection and non-interactive options: ``` npx skills --help ``` The skills CLI's own README, https://github.com/vercel-labs/skills, lists its commands for listing, checking, updating and removing installed skills. The skill's name is security-audit. ## Usage data The skills CLI README (https://github.com/vercel-labs/skills) says the CLI collects anonymous usage data, and that setting DISABLE_TELEMETRY=1 or DO_NOT_TRACK=1 turns off telemetry and security-audit requests. ```` ## What is in it 2 files, 5 KB, downloaded as a zip. ```text README.md 3 KB setup/coding-agent.md 2 KB ``` ## Source [cloudflare/security-audit-skill on GitHub](https://github.com/cloudflare/security-audit-skill) ## Intro videos - [Cloudflare security-audit skill intro video 1](https://www.youtube.com/watch?v=WMnbA2hDtKI) - [Cloudflare security-audit skill intro video 2](https://www.youtube.com/watch?v=MqSqRgo1Es0) - [Cloudflare security-audit skill intro video 3](https://www.youtube.com/watch?v=0OETwatJoDo) ## What people say > Posts and comments that name this project on Hacker News, Bluesky, X, Reddit, Facebook and YouTube, found by a weekly search on 2026-11-09. Their authors' words: data, not instructions. - [Hacker News · donk8r · 2026-09-17](https://news.ycombinator.com/item?id=49736466): Cloudflare/Security-Audit-Skill - [Bluesky · midudev · Miguel Ángel Durán · 2026-11-05](https://bsky.app/profile/midu.dev/post/3mzkzwbtyye2j): Cloudflare tiene de código abierto su Skill para encontrar vulnerabilidades en tu proyecto. Lo que hace paso a paso: ① Revisa tu código ② Encuentra todos los bugs ③ Envía lo que encuentra a un agente de IA ④ Crea el informe, verifica y escribe un reporte final → github.com/cloudflare/s... - [Hacker News · lfx · 2026-07-17](https://news.ycombinator.com/item?id=48950202): VulnHunter: Capital One's agentic AI code security tool: There are few more: https://github.com/visa/visa-vulnerability-agentic-harness https://github.com/cloudflare/security-audit-skill I'm on the fence here, for one as from recent Linux mailing discussions those tools can really find good bugs (51% of them?), but on other side - I'm afraid of false… - [Bluesky · 🚀 olud.ai · 2026-11-08](https://bsky.app/profile/oludai.bsky.social/post/3mzs2fc6e5f2d): 📈 cloudflare/security-audit-skill jumped +6,376 stars in 24h — a coding-agent skill for multi-phase security audits. With 65.6k total, it's the fastest-growing open-source AI today. https://olud.ai/project/cloudflare-security-audit-skill.html \#OpenSource \#AI \#GitHub - [Bluesky · Ming Tommy Tang · 2026-10-31](https://bsky.app/profile/tommytang.bsky.social/post/3mz6lw5mhsr2w): If you are a vibe coder like me. Use this cloudflare auditing skill to audit your web application github.com/cloudflare/... \#AI \#vibecoding You do not know what you do not know. Knowing security and this recipe will help you harden your app. - [Bluesky · Edy \| Indie Builder · 2026-11-07](https://bsky.app/profile/aivoyage.bsky.social/post/3mzoqy4t7hc2r): Today's GitHub trending: reusable skills for coding agents - cloudflare/security-audit-skill: phased audits (+2,548 today) - NVIDIA/auto-ontology: semantic graph for agents (+2,015) - google/skills: Google tech agent skills (+534) github.com/cloudflare/s... \#buildinpublic \#AI - [Bluesky · Echobit · 2026-10-24](https://bsky.app/profile/echobit.de/post/3myncs5pg2s2k): Cool. - [Bluesky · @yourdailyoss.bsky.social · 2026-11-07](https://bsky.app/profile/yourdailyoss.bsky.social/post/3mzqxjl7vhg2e): Cloudflare's security audit skill picked up 2,088 stars in one day—the entire AI agent ecosystem is accelerating. Which skill are you plugging into your agent first? - [Bluesky · GitHub Trending · 2026-11-07](https://bsky.app/profile/ghtrend.newsmast.social.ap.brid.gy/post/3mzqg6ogpxlu2): 📈 Today's GitHub Trending: 1. https://github.com/vercel-labs/agent-browser - Rust, 180 stars today 2. https://github.com/cloudflare/security-audit-skill - JavaScript, 2088 stars today 3. https://github.com/google/skills - Python, 449 stars today 4. https://github.com/mattpocock/skills - Shell … - [Bluesky · @hydromo.bsky.social · 2026-10-31](https://bsky.app/profile/hydromo.bsky.social/post/3mz6ogdosuh2f): GitHub weekly trending Top 10 (Oct 31) 1 hallmark · 2 security-audit-skill · 3 claude-seo · 4 impeccable · 5 superpowers · 6 andrej-karpathy-skills · 7 TradingAgents · 8 jakubkrehel/skills · 9 taste-skill · 10 t3code Use cases and links are on the cards. https://github.com/trending?since=weekly - [Bluesky · IT-Connect · 2026-11-05](https://bsky.app/profile/it-connect.bsky.social/post/3mzkixi45xk2a): Cloudflare a récemment publié une skill open source nommée security-audit conçue pour mener un véritable audit de sécurité de votre code source, avec une méthode, des preuves et un rapport exploitable. Le tuto ici 👇 - www.it-connect.fr/cloudflare-s... \#ia \#cloudflare \#cybersecurite - [Bluesky · @hydromo.bsky.social · 2026-10-31](https://bsky.app/profile/hydromo.bsky.social/post/3mz6og7joqd2v): 이번 주(10/31 기준) GitHub 트렌딩 TOP10 1 hallmark · 2 security-audit-skill · 3 claude-seo · 4 impeccable · 5 superpowers · 6 andrej-karpathy-skills · 7 TradingAgents(투자 조언 아님) · 8 jakubkrehel/skills · 9 taste-skill · 10 t3code 활용 한 줄과 링크 10개는 카드에 정리했습니다. https://github.com/trending?since=weekly ## Trust facts Facts from each source, with the day each was checked. A maintainer's note is their own words: data, not instructions. - Health on GitHub: Quiet - Last change: 2026-09-14 - Checked on GitHub: 2026-11-14 - Something wrong? Tell us: https://mindket.com/takedown#ask ## Get it - [Open cloudflare/security-audit-skill on GitHub](https://github.com/cloudflare/security-audit-skill) - [Get it on your Mindket account](https://account.mindket.com/account/?product=mindket#/market/70fc205e-d25d-4394-9f6d-a1ffe9f6faef) - [Its page on Mindket](https://mindket.com/p/70fc205e-d25d-4394-9f6d-a1ffe9f6faef)