security-audit

An agent skill by cloudflare, from cloudflare/security-audit-skill. Tags: api, cli, debugging, devops, research, security.

What it does

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add cloudflare/security-audit-skill --skill security-audit

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/cloudflare/security-audit-skill
cp -r security-audit-skill/skills/security-audit ~/.claude/skills/security-audit

Safety box score

Not rated yet. A safety box score grades what a skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. Anyone can request one from this page; it is saved for everyone. How the score works.

Source

Repository

cloudflare/security-audit-skill (all skills from this repository)

Path

skills/security-audit/SKILL.md

Branch

main

Updated

2026-09-19

Related skills

• address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
• modern-cpp — Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++.
• chaos-engineer — Designs chaos experiments, creates failure injection frameworks, and facilitates game day exercises for distributed systems — producing runbooks.
• code-review — Review code for actionable defects. Correctness is the core; performance and security are optional sub-cases of the same engine.
• java-architect — x, microservices, or reactive programming.
• kubernetes-specialist — Use when deploying or managing Kubernetes workloads.