# Cloudflare Security Audit Skill

> Draft · awaiting review.

> Agent skill that runs a multi-phase, source-first security audit of a codebase and verifies each candidate finding.

- Badge: `reach 2 · not run yet`
- Type: Skill; tier: not run yet
- Tasks: Code review and static analysis (SAST); mission: Defensive; works with: Claude Code
- Source: https://github.com/cloudflare/security-audit-skill (skills/security-audit), pinned to `c1c8a8c`, licence MIT
- Last checked: 2026-10-19; next check: 2027-01-17; method v0.1, reach-v0.1

## At a glance

- **What it is:** An agent skill for security guidance and vulnerability review of codebases, APIs, services, CLI tools, libraries and daemons. It runs the complete audit workflow only for an explicit codebase audit or pen-test request, a full or end-to-end review, or requested report artifacts. A skill is a set of instructions, and sometimes scripts, that your AI client loads when a task needs it.
- **Made for:** Finds vulnerabilities that cross a real trust boundary and gives owners source evidence, safe reproduction, priority and the smallest effective fix. +2 more
- **Runs:** Inside your AI client: its model follows the instructions and works with the client's own tools. Other modes: full audit mode; run profile.
- **Sends data to:** No outside connection found in the files read. Other connections not ruled out: read in the documentation and the cited code, not searched in full.
- **Can change things:** Changes, runs commands, according to the capabilities read.
- **Needs:** A coding agent whose model supports tool use and parallel sub-agents · Node.js to run the findings and coverage-ledger validators · OS-enforced sandbox (no external network, allowlisted env, resource limits, scratch-only writes) to run target code; without it leads stay needs_validation · +1 more

Profile read at commit `c1c8a8c` on 2026-10-25; every fact cites a file and line at that commit.

## What it does

An agent skill for security guidance and vulnerability review of codebases, APIs, services, CLI tools, libraries and daemons. It runs the complete audit workflow only for an explicit codebase audit or pen-test request, a full or end-to-end review, or requested report artifacts. (skills/security-audit/SKILL.md#L3)

Made for (the author says):

- Finds vulnerabilities that cross a real trust boundary and gives owners source evidence, safe reproduction, priority and the smallest effective fix. (skills/security-audit/SKILL.md#L8)
- Turns a coding agent into a security auditor that coordinates isolated agents through reconnaissance, hunting, validation, verification and reporting. (README.md#L3)
- Answers security questions and supports focused reviews, methodology, triage and investigation of specific findings. (skills/security-audit/SKILL.md#L14)

Documented uses:

- Audit a codebase for security vulnerabilities from its source with a coding agent started in or pointed at the repository. [Code review and static analysis (SAST)] (README.md#L70)
- Review code where a language model takes part in trust-sensitive decisions: RAG pipelines, agent memory, tool-calling loops, MCP servers and clients. [Code review and static analysis (SAST)] (skills/security-audit/AI-AND-LLM.md#L5)
- Review cloud identity, infrastructure-as-code, container, Kubernetes and serverless definitions in a repository. [Cloud and infrastructure-as-code (IaC) posture] (skills/security-audit/CLOUD-AND-DEPLOYMENT.md#L5)
- Review dependency resolution, CI, release, signing and plugin loading in a repository for supply-chain flaws. [Dependencies and secrets] (skills/security-audit/SUPPLY-CHAIN-AND-RELEASE.md#L5)

Not for (the author says):

- The author rules out probing deployed endpoints, external services, shared infrastructure, production identities, other users' data or live control planes. (skills/security-audit/SKILL.md#L42)
- The audit describes fixes and does not modify target source. (skills/security-audit/SKILL.md#L166)

## What it can do

| Group | What it covers | Effect | On by default |
|---|---|---|---|
| Guidance mode | Answers security questions, focused reviews and triage with the relevant parts of the skill, without audit artifacts; it may launch focused agents. (skills/security-audit/SKILL.md#L14) | reads | yes |
| Reconnaissance | Maps architecture, trust boundaries, input surfaces, prior evidence and deterministic coverage into architecture.md and coverage-ledger.json. (README.md#L11) | reads, changes | no |
| Coverage-led hunting | Assigns isolated hunter agents to ledger units, records their checks and runs coverage-critic waves to find gaps. (README.md#L12) | reads | no |
| Use bounded local evidence | Runs sandboxed local tests (function harness, existing unit test, parser fixture, isolated-loopback client) to resolve behavior when all execution controls are available. (skills/security-audit/SKILL.md#L144) | runs commands | no |
| Candidate validation | Gives every unique candidate to a fresh verifier agent that tries to disprove it. (README.md#L13) | reads | no |
| Structured output | Writes confirmed, needs_validation and rejected records to findings.json and checks them against report-schema.json. (README.md#L14) | changes | no |
| Independent record verification | Fresh agents re-verify final source claims; a material replacement record goes to another independent verifier. (README.md#L15) | reads | no |
| Target-neutral reporting | Derives REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md from the verified records and the coverage ledger. (README.md#L16) | changes | no |
| Findings and coverage-ledger validators | The parent runs validate-coverage-ledger.cjs after creating and after each update of the ledger, and validate-findings.cjs in Phase 4 and after every Phase 5 replacement. (README.md#L18) | reads, runs commands | no |
| ATTACK-CLASSES.md and domain companions | Attack classes from ATTACK-CLASSES.md selected for the application type, extended with application-specific classes from Phase 1 and split per subsystem for large codebases. (skills/security-audit/ATTACK-CLASSES.md#L5) | reads | yes |

## How it runs

Markdown instructions the coding agent's model follows: a parent agent coordinates the run and owns shared state, and delegates through the platform's Task tool to research agents for source exploration and general agents for investigation and bounded local execution. (skills/security-audit/SKILL.md#L23-26)

- Starts: Inside your AI client: its model follows the instructions and works with the client's own tools. Instructions the coding agent's model follows; the skill activates when a request matches its trigger. (README.md#L84)
- Can also run: Inside your AI client: its model follows the instructions and works with the client's own tools (full audit mode). Runs all six phases and writes run files when the user explicitly asks for a codebase audit, pen test, full review or report artifacts. (skills/security-audit/SKILL.md#L15)
- Can also run: Inside your AI client: its model follows the instructions and works with the client's own tools (run profile). Picks a run profile from the user's request or proposes one; standard is the default and the choice is recorded in run-metadata.json. (skills/security-audit/SKILL.md#L109)
- Your AI client: **SKILL.md**: SKILL.md holds setup, core principles, platform terminology, workflow overview and audit anti-patterns for the agent. (README.md#L28)
- Your AI client: **Parent agent**: The parent agent coordinates the run and owns shared state. (skills/security-audit/SKILL.md#L23)
- Your machine: **Output directory**: New writable directory outside the target, default ~/security-audit-skill/<repo-name>/run-<N>; inside the target only if the user picks a VCS-ignored path. (skills/security-audit/SKILL.md#L51)
- Your machine: **validate-findings.cjs**: validate-findings.cjs, a zero-dependency validator for findings.json used in Phases 4 and 5. (README.md#L44)
- Your machine: **Target repository**: The repository under review, read by the agents for source inspection. (skills/security-audit/SKILL.md#L49)
- Your machine: **OS-enforced sandbox**: User-provided OS-enforced sandbox in which target-controlled builds, tests and fixtures run. (README.md#L90)

## What you need

- Other: A coding agent whose model supports tool use and parallel sub-agents. (README.md#L88)
- Runtime: Node.js to run the findings and coverage-ledger validators. (README.md#L89)
- Operating system: OS-enforced sandbox (no external network, allowlisted env, resource limits, scratch-only writes) to run target code; without it leads stay needs_validation. (README.md#L90)
- Other tools: Target toolchains and dependencies must already be present locally; the skill tells agents not to install or fetch them. (skills/security-audit/SKILL.md#L40)
- Installer: Installs with npx skills add pointed at the GitHub repository URL and --skill security-audit; the command pins neither the Skills CLI version nor a commit. (README.md#L53-56)
- Installer: Adding --global installs the skill at user level. (README.md#L58-64)
- Installer: Agent selection and non-interactive install options are documented in npx skills --help. (README.md#L66)

## Limits and risks

- Without the sandbox controls the workflow keeps a lead as needs_validation instead of executing target code. (README.md#L90)
- A reconnaissance agent reports whether the local platform can enforce the sandbox controls; missing controls block target-controlled execution. (skills/security-audit/RECONNAISSANCE.md#L53)
- The author reports that in their test runs a single run found roughly half of the vulnerabilities that repeated runs found in total. (README.md#L98)
- The obvious-things hunter checks the audited repository for committed .env, .env.local, credentials.json, *.pem and *.key files. (skills/security-audit/ATTACK-CLASSES.md#L118)
- The wildcard hunter is told to look at git history for reverted security fixes, commented-out auth checks and secrets committed then removed. (skills/security-audit/ATTACK-CLASSES.md#L103)
- In full audit mode the default output directory is in the user's home under ~/security-audit-skill/<repo-name>/run-<N>. (README.md#L84)
- Reproduction records keep allowlisted variable names and safe values; agents are told never to capture the ambient environment, credential values or authentication state. (skills/security-audit/SKILL.md#L84)
- The author states that validator success proves format and ledger consistency, not the correctness of findings. (skills/security-audit/VALIDATION-AND-REPORTING.md#L118)
- In full audit mode the agent is told not to end the run until all Phase 6 artifacts are written and both validators pass, or an incomplete run status with its reason is recorded. (skills/security-audit/SKILL.md#L179)
- A strict agent budget can still be exceeded by an unexpectedly large candidate set or by a material Phase 5 replacement that needs another independent verifier. (skills/security-audit/SKILL.md#L134)
- When a request could mean guidance or full audit mode, the skill asks one focused question before creating files or starting the complete workflow. (skills/security-audit/SKILL.md#L17)
- Reconnaissance reads the target and its local build and configuration state; it does not contact deployed endpoints, external identity providers, registries, brokers or cloud APIs. (skills/security-audit/RECONNAISSANCE.md#L5)
- Agents may make a disposable copy of target source in their assigned scratch/ directory when a build must write beside source. (skills/security-audit/SKILL.md#L40)

## Rights in plain language

- Declared: files 2 (writes outside the project), network 0 (uses no network), execution 2 (runs shell commands or eval), secrets 0 (touches no credentials), persistence 1 (leaves cache or temp files).
- Code: reach 2 (open): files 2 (writes outside the project), execution 2 (runs shell commands or eval), secrets 2 (reads broad tokens or the environment).
- Lab: not run yet.

Why three columns? Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

## Privilege Reach

Reach level 2 (open).

| Right | Declared | Code | Lab |
|---|---|---|---|
| Files: where does it read and write? | 2 writes outside the project | 2 writes outside the project | not run yet |
| Network: whom does it talk to? | 0 uses no network | 0 uses no network | not run yet |
| Execution: what does it run? | 2 runs shell commands or eval | 2 runs shell commands or eval | not run yet |
| Secrets: which credentials does it touch? | 0 touches no credentials | 2 reads broad tokens or the environment | not run yet |
| Persistence: what survives the run? | 1 leaves cache or temp files | 1 leaves cache or temp files | not run yet |
| Approval: does it ask before acting? | not declared | 0 asks each time | not run yet |

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe

## Install

### Upstream

Quoted from `README.md#L54-55` at the pinned commit (not a command to copy): `npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit`


### Run it with least privilege

- claude code: `permissions.allow: [Read, Grep]; run in guidance mode unless you pass an explicit audit request, and provide an OS-enforced sandbox with no network before a full audit; without one the skill only reviews source and records the missing control as a blocker`
- note: `derived from the code, not tested in the lab`

- derived, not tested: proposed from the code analysis

## Lab runs

Not run yet.

## Questions and answers

**Why compare declared, code and lab?**

Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

**What rights does Cloudflare Security Audit Skill declare?**

files 2 (writes outside the project), network 0 (uses no network), execution 2 (runs shell commands or eval), secrets 0 (touches no credentials), persistence 1 (leaves cache or temp files).

**What does its code suggest?**

reach 2 (open): files 2 (writes outside the project), execution 2 (runs shell commands or eval), secrets 2 (reads broad tokens or the environment).

**What did it use when it ran in the lab?**

not run yet.

**Was it tried, and when?**

Not yet (tier listed).

**What changed since the last check?**

Upstream last pushed 2026-09-14; 0 release(s) since the pinned version.

**How do I run it with least privilege?**

Derived, not tested: claude_code: permissions.allow: [Read, Grep]; run in guidance mode unless you pass an explicit audit request, and provide an OS-enforced sandbox with no network before a full audit; without one the skill only reviews source and records the missing control as a blocker; note: derived from the code, not tested in the lab

Method: https://readbeforerun.ai/method/