security-audit
Security guidance and vulnerability review for codebases, APIs, services
by cloudflareFree
Description
Security-audit is a defensive, source-first agent skill for finding vulnerabilities in codebases, APIs, services, CLI tools, libraries and daemons. It looks for issues that break a real trust boundary and holds each finding to a standard: a candidate is only confirmed when it has a concrete affected principal, resource or security outcome. For each confirmed finding the skill gives the owner the source evidence, a safe way to reproduce the problem, a priority, and the smallest effective fix. It has two modes. By default it works as guidance, so a security question or a focused review uses only the relevant parts and does not write audit files. The full audit mode runs all six phases and writes report artifacts, and it is used when you explicitly ask for an audit or a pen-test of a codebase, or for a full, comprehensive or end-to-end review. If a request could mean either mode, the skill asks one focused question first. It is agent-neutral, and it is published by Cloudflare.…
Highlights
- Finds vulnerabilities that cross a real trust boundary
- Gives source evidence, safe reproduction, priority and the smallest fix
- Guidance mode for focused questions and reviews
- Full audit mode with six phases and report files on request
Ratings & Reviews
No ratings yet
Be the first to rate security-audit.
People also visit
canvas-design
Create beautiful visual art in .png and .pdf documents using design philosophy
security-audit FAQ
What does security-audit review?
Codebases, APIs, services, CLI tools, libraries and daemons, looking for vulnerabilities that cross a real trust boundary.
What is the difference between the two modes?
Guidance mode answers focused questions without creating files. Full audit mode runs six phases and writes report artifacts.
When does it write files?
Only in full audit mode, when you ask for a complete audit, a pen-test or report artifacts.
How is a finding confirmed?
A candidate must have a concrete affected principal, resource or security outcome. Without it, the skill does not treat it as confirmed.
Who is it for?
Developers and security reviewers who want a source-first review of their code.
How do I install it?
Run npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit in your terminal.
Is it free?
The listing shows the skill as free.
What are the best security-audit alternatives?
Popular alternatives to security-audit include implement, brand-guidelines and canvas-design. See all security-audit alternatives