# Security Audit

Reviews codebases, APIs, and services for vulnerabilities and runs pen-test workflows.

- Repository: https://github.com/cloudflare/security-audit-skill (56287 stars)
- Category: Security
- License: MIT
- Last updated: 2026-09-14
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add cloudflare/security-audit-skill --skill security-audit -g -a claude-code -y`
Codex: `npx skills add cloudflare/security-audit-skill --skill security-audit -g -a codex -y`
Cursor: `npx skills add cloudflare/security-audit-skill --skill security-audit -g -a cursor -y`
Gemini CLI: `npx skills add cloudflare/security-audit-skill --skill security-audit -g -a gemini-cli -y`

## Description

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Security Audit

Find vulnerabilities that violate a real trust boundary, then give owners the source evidence, safe reproduction, priority, and smallest effective fix. This is a defensive, source-first workflow. A candidate without a concrete affected principal, resource, or security outcome is not a confirmed finding.

## Operating modes

This skill is guidance by default. Loading it does not authorize the complete audit workflow or file creation.

- **Guidance mode**: For security questions, focused reviews, methodology, triage, or investigation of specific findings, use only the relevant parts of this skill. Do not automatically run all six phases, create an output directory, or write audit artifacts. You may launch focused agents when useful; they return results to the current task.
- **Full audit mode**: Use the complete workflow when the user explicitly asks to audit or pen-test a codebase, asks for a full, comprehensive, or end-to-end security review, or requests report artifacts. Run all six phases and write the files defined below.

If the request could mean either mode, ask one focused question before creating files or starting the complete workflow.

## Platform terminology

This skill is agent-neutral:

- **Parent** is the agent that coordinates the run and owns shared state.
- **Task tool** is the platform's delegation or sub-agent mechanism.
- **`research` agent** is a delegated agent for focused source exploration and factual verification.
- **`general` agent** is a delegated agent for broad investigation and bounded local execution.
- **`subagent_type:`** in a heading names which of these two delegated agent roles runs that work.

Use equivalent platform capabilities while preserving role, write-isolation, prompt, and independence boundaries.

## Universal execution safety

The rest: https://github.com/cloudflare/security-audit-skill/blob/HEAD/skills/security-audit/SKILL.md