Security Audit (Cloudflare)
A six-phase security audit where every finding is checked by a second agent
About
The skill that seeded Cloudflare's internal vulnerability discovery harness. Ask your agent to "security audit this codebase" and it maps the architecture and trust boundaries, sends isolated hunters through a coverage ledger, hands every candidate to a fresh agent that tries to disprove it, then writes confirmed, needs_validation and rejected findings to a JSON schema plus a readable report. Repeat runs are additive and target the gaps.
Install
Works with Claude Code, Codex, Cursor, OpenCode
Access
MediumWhat this skill's own files let it touch on your machine and accounts. Access isn't a verdict: check the publisher and the security audits too.
- Bundles scripts
- Runs shell commands
- Writes files in your project
- No network access
- No credentials needed
Guidance only by default: the full six-phase audit and its files start only when you explicitly ask for an audit or pen test. Source inspection is read-only. Two zero-dependency Node validators check the findings and coverage files. The skill asks for an OS-enforced sandbox (no external network, limited writes) before running any target code, and keeps a lead as needs_validation instead of executing code when no sandbox is available. Reports go to ~/security-audit-skill/<repo>/run-<N> unless you choose a folder.
Reviewed from source on Oct 20, 2026. Read the files yourself before installing.
More Security skills
All skillsRelated articles
All articles
AI Agent Sandboxes Compared (2026)
I compare E2B, Perplexity SPACE, NVIDIA OpenShell, Anthropic srt and Kernel on isolation, pricing, free tiers, MCP support and real install commands.
Browser Automation for AI Agents (2026)
I compare five ways to give an AI agent a browser, from local Chrome over MCP to hosted cloud browsers, with real install commands and pricing.
Langfuse vs Braintrust (2026): Pricing, Self-Hosting, MCP
I compare Langfuse and Braintrust for LLM tracing and evals: free tiers, paid plans, self-hosting, open source status and their MCP servers.