Security Audit Skill
Multi-phase security audit with machine-readable findings.
Use it for
Auditing a small codebase where the findings need to be actionable
Skip it if
Compliance evidence; an agent audit is not a certification
What it is
Runs a structured audit in phases and produces findings that a machine can verify rather than prose a human has to trust. The important design choice is the verification step: each finding has to be independently reproducible, which removes the confident-but-wrong class of report. Maintained by Cloudflare, so the bar for accepting a finding is theirs, not a hobbyist's.
Install
Clone the repository, then copy the skill folder into your agent's skills directory — ~/.claude/skills/ for Claude Code. Skills are plain files: no build step, no daemon.
npx skills add https://github.com/cloudflare/security-audit-skillHow to judge it
Read the SKILL.md before you install. A good skill states when it applies, what it must not do, and how to verify the result. A skill that only lists adjectives will change the agent's tone without improving its output — skip those.
Other Coding & Dev skills
- Agent Skills by Addy Osmani — Engineering skills aimed at production code: review, testing, refactoring, and release hygiene.
- Archify — Turns a plan, a spec, or a codebase into an interactive architecture diagram.
- Ponytail — Makes the agent argue for less code before it writes more.