security-audit agent skill by cloudflare
Provides security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons, including focused reviews, vulnerability research, audits, and pen tests.
At a glance
| Publisher | Cloudflare Official |
|---|---|
| Repository | github.com/cloudflare/security-audit-skill |
| Category | Security |
| License | MIT |
| Last commit | September 14, 2026 (repository) |
| SKILL.md | 187 lines, 3,065 words |
| Bundled files | 20 files |
| Quality score | 72/100 · C Passes all seven graded checks |
| Security scan | Not scanned |
| README badge | Get the listing badge and raise the score |
Before you install
Read from the skill's files at the directory's October 19, 2026 snapshot: what ships with it, what its code reads, and the terms it is published under.
- Bundled scripts: 4 script files (4 JavaScript). Your agent may run them, so read them first.
- License: MIT, an open-source or open-content license.
Install security-audit
The skills CLI works with Claude Code, Codex, Cursor and other agents; the other routes copy the folder by hand.
npx skills add https://github.com/cloudflare/security-audit-skill/tree/main/skills/security-audittmp="$(mktemp -d)"
git clone --depth 1 https://github.com/cloudflare/security-audit-skill.git "$tmp/repo"
mkdir -p .claude/skills
cp -R "$tmp/repo/"skills/security-audit .claude/skills/
rm -rf "$tmp"python3 ~/.codex/skills/.system/skill-installer/scripts/install-skill-from-github.py \
--repo cloudflare/security-audit-skill \
--path skills/security-auditcloudflare/security-audit-skill is third-party code. Read SKILL.md and any bundled scripts before you install it.
How the author describes it
Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.
From the description field of SKILL.md. Agents read this line to decide when to load the skill.
Sections in SKILL.md
- Operating modes
- Platform terminology
- Universal execution safety
- Full audit setup
- Write isolation
- Full audit planning
- Coverage and prior runs
- Run profiles and scope
- Core principles
- Require a boundary and result
- Use bounded local evidence
- Respect source visibility
- Separate priority from certainty
- Recommend the smallest effective source fix
- Full audit workflow
- Anti-patterns
Files in the skill folder
AI-AND-LLM.mdATTACK-CLASSES.mdCLIENT-SIDE.mdCLOUD-AND-DEPLOYMENT.mdDATA-ISOLATION-AND-LIFECYCLE.mdDESKTOP-MOBILE-AND-LOCAL-IPC.mdHUNTING.mdMEMORY-SAFETY-AND-BINARY.mdPROTOCOLS-RPC-AND-MESSAGING.mdRECONNAISSANCE.mdRESOURCE-EXHAUSTION-AND-AVAILABILITY.mdSKILL.mdSUPPLY-CHAIN-AND-RELEASE.mdVALIDATION-AND-REPORTING.mdWEB-PROTOCOL-AND-AUTH.mdreport-schema.jsonvalidate-coverage-ledger.cjsvalidate-coverage-ledger.test.cjsvalidate-findings.cjsvalidate-findings.test.cjs
Suede Skill Check: 72/100 · C
Report snapshot · · graded-v2
The rubric totals 100 points; published scores are capped at 99. Security scan: not scanned.
Source revision: c1c8a8c14710. Report version 31e7bee2986c. Badge URLs follow the latest listing; save the report to keep this version.
Download report · Request a fresh review
What to review next
- Boundary clause: 0 of 4 points. 4 when the description says when not to use the skill (“Not for …”, “Do not use …”, “Use … instead”).
- Example request: 0 of 3 points. 3 when the description quotes an example request (3–60 characters in quotation marks).
- Instruction depth: 4 of 7 points. 7 for a SKILL.md body of 500–3,000 words; 4 for 250–4,500; 1 for 100 or more.
Add declarations and bundled files when they describe the skill’s actual needs. Update the source, then request a fresh review with the changed commit or PR.
security-audit passes the required frontmatter check and all seven graded checks, which cover the SKILL.md format, a declared license and a commit in the last year. Those checks earn 56 of the score’s points; the rest come from description quality, instruction depth, bundled files, maintenance and curated-list citations. How the score works.
See the checks and points
| Check | Result |
|---|---|
| Frontmatter parses and declares a name and a description | Pass |
| Name uses lowercase letters, digits and hyphens, 64 characters or fewer | Pass |
| Name matches the skill's folder name | Pass |
| Description is between 50 and 1,024 characters | Pass |
| Description says when an agent should use the skill | Pass |
| SKILL.md body is 500 lines or fewer | Pass |
| A license is declared in the frontmatter or the repository | Pass |
| Repository has a commit in the last 12 months | Pass |
| Score component | Points |
|---|---|
| Structural checks | 56 of 56 |
| Description length | 5 of 5 |
| Boundary clause | 0 of 4 |
| Example request | 0 of 3 |
| Instruction depth | 4 of 7 |
| Reference files | 0 of 3 |
| Bundled scripts | 0 of 2 |
| Recent maintenance | 6 of 9 |
| Curated-list citations | 1 of 7 |
| Tool permissions declared | 0 of 2 |
| Compatibility declared | 0 of 2 |
Show the listing and raise the score
security-audit is listed with 72/100 · C. This badge links to its Suede listing. Skills scoring 80–99 add a numeric and a letter quality shield; the largest open points for security-audit are boundary clause (4), example request (3) and instruction depth (3). Send your repository and the points you want to raise, then request a fresh review after updating the skill.
[](https://skills.suedeai.ai/directory/cloudflare/security-audit-skill/security-audit/)<a href="https://skills.suedeai.ai/directory/cloudflare/security-audit-skill/security-audit/"><img src="https://skills.suedeai.ai/directory/badge.svg" alt="Suede Skills Directory: listed" height="20"></a>Where this skill is cited
cloudflare/security-audit-skill appears in 1 curated list: VoltAgent/awesome-agent-skills.