Security Audit
Lets your agent review code for real vulnerabilities and write defensive, evidence-based findings.
- Repository
- cloudflare/security-audit-skill
- Stars
- 56,863
- Licence
- MIT
- Files
- 15 files
What it does
Once installed, the agent approaches code reviews like a security reviewer. It looks for weaknesses that cross a real trust boundary, such as one user reaching another user's data, and explains each with source-code evidence, a safe way to reproduce it, a priority, and the smallest sensible fix. For quick questions or focused reviews it just gives guidance; only when you explicitly ask for a full audit or pen test does it run a six-phase workflow that writes report files and may run sandboxed local tests.
Great for
- Developers who want a second pair of security eyes on a service, API, CLI tool, or library
- Security engineers who want a structured, source-first triage and report-writing workflow
- Teams preparing for a pen test or a pre-release security review
Skip it if
- Replacing a professional penetration test or formal security certification, since it is limited to the files and sandboxed checks it can run
- Testing live or production systems: the skill explicitly forbids probing deployed endpoints or shared infrastructure, but a user who ignores that guidance could still cause harm
- Non-defensive offensive use against systems you do not own or have permission to test
Try asking
- “Review the authentication and session handling in this API for security issues”
- “Do a focused review of how this service validates uploaded files”
- “Run a full security audit of this repository and write the report files”
- “Explain the trust boundaries in this CLI tool and which inputs are untrusted”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 15 original files, the MIT licence and an attribution note.
security-audit.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip security-audit.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip security-audit.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Start with a focused question rather than a full audit; the skill only writes files and runs the complete workflow when you explicitly ask for it or a report.
- Name the component and the trust boundary you care about (for example, tenant isolation or admin-only endpoints) to get more useful findings.
- Provide an external output directory path for full audits so report artifacts stay outside the repository.
What's inside
- AI-AND-LLM.md
- ATTACK-CLASSES.md
- CLIENT-SIDE.md
- CLOUD-AND-DEPLOYMENT.md
- DATA-ISOLATION-AND-LIFECYCLE.md
- DESKTOP-MOBILE-AND-LOCAL-IPC.md
- HUNTING.md
- MEMORY-SAFETY-AND-BINARY.md
- PROTOCOLS-RPC-AND-MESSAGING.md
- RECONNAISSANCE.md
- RESOURCE-EXHAUSTION-AND-AVAILABILITY.md
- SKILL.md
- SUPPLY-CHAIN-AND-RELEASE.md
- VALIDATION-AND-REPORTING.md
- WEB-PROTOCOL-AND-AUTH.md
Redistributed unmodified from cloudflare/security-audit-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.