Cloudflare Security Audit Skill

Draft · awaiting review

Agent skill that runs a multi-phase, source-first security audit of a codebase and verifies each candidate finding.

For Code review and static analysis (SAST)Works with Claude CodeMaintained cloudflare, last push 2026-09-14

SkillA skill is a set of instructions, and sometimes scripts, that your AI client loads when a task needs it. by cloudflare · read from the code at c1c8a8c on 2026-10-19The date we last read the tool’s files. The code after “at” names the exact version (the git commit) we read; a newer version may differ. · Not run yet.Whether we have run the tool in our lab. “Did more than it said” means the run used rights its description does not name; “did no more than it said” means it stayed within them.

Code showsWhat a reading of the code found the tool can do, at the checked version, in the words of the rights table in the record. It is a ceiling, not what the tool did. A right marked unknown has no evidence either way, and that never counts as harmless.

What the code shows, worst first. No run advice yet: the one word needs a read under the full rule.

Level 2. Files. Write target is a new directory under the user's home, outside the audited repository.
SKILL.md L51
Level 2. Execution. Hunters run the target's own builds, tests and fuzzers, i.e. arbitrary target code.
HUNTING.md L163
Level 2. Secrets. The skill reads committed .env, credentials.json, .pem and .key files inside the audited repository to find hardcoded secrets: several secret files in the working directory (secrets 2, credential stores outside it would be 3).
ATTACK-CLASSES.md L118

Before first useSettings for your AI client that limit the tool to the rights its task needs; derived from the code unless marked tested. derived from the code, not tested

Claude Code: permissions.allow: [Read, Grep]; run in guidance mode unless you pass an explicit audit request, and provide an OS-enforced sandbox with no network before a full audit; without one the skill only reviews source and records the missing control as a blocker.

What we checked, and what we found Disagree?

Skill · code showsreach 2 · open

What the code can reach, 0 to 3 per right; a dashed point means no evidence, never zero. The three readings

Is it for you?

Made for: Finds vulnerabilities that cross a real trust boundary and gives owners source evidence, safe reproduction, priority and the smallest effective fix.
Turns a coding agent into a security auditor that coordinates isolated agents through reconnaissance, hunting, validation, verification and reporting.
Answers security questions and supports focused reviews, methodology, triage and investigation of specific findings.
Use it when: Audit a codebase for security vulnerabilities from its source with a coding agent started in or pointed at the repository Code review and static analysis (SAST)
Review code where a language model takes part in trust-sensitive decisions: RAG pipelines, agent memory, tool-calling loops, MCP servers and clients Code review and static analysis (SAST)
Review cloud identity, infrastructure-as-code, container, Kubernetes and serverless definitions in a repository Cloud and infrastructure-as-code (IaC) posture
Review dependency resolution, CI, release, signing and plugin loading in a repository for supply-chain flaws Dependencies and secrets
Not for: The author rules out probing deployed endpoints, external services, shared infrastructure, production identities, other users' data or live control planes.
The audit describes fixes and does not modify target source.
You need: A coding agent whose model supports tool use and parallel sub-agents
Node.js to run the findings and coverage-ledger validators
OS-enforced sandbox (no external network, allowlisted env, resource limits, scratch-only writes) to run target code; without it leads stay needs_validation
+1 more
Details: You need

Install

linked, not distributed: the Field Guide does not bundle agents or MCP servers

Upstream

npx skills add https://github.com/cloudflare/security-audit-skill \ --skill security-audit
Quoted from README.md#L54-55 at the pinned commit; a quotation, not a command to copy.

Run it with least privilege

claude code: permissions.allow: [Read, Grep]; run in guidance mode unless you pass an explicit audit request, and provide an OS-enforced sandbox with no network before a full audit; without one the skill only reviews source and records the missing control as a blocker
note: derived from the code, not tested in the lab

derived, not tested: proposed from the code analysis

End of the card. Below: what we checked, and what we found.Markdown JSON

The record · every value with its evidence

What we checked, and what we found.

Profile read at commit c1c8a8c on 2026-10-25: 52 facts, each with its quoted line confirmed by script; not installed, not run in the lab.Each fact was read from the tool's files at the checked version and links to the line it comes from. Where nothing was found, the page says so instead of assuming “none”.

Selected by criteria v0.1, approved by Ilja Schlak: awaiting approval. Each section opens with the answer; the file and line of every fact follow it.

What it can change the capability groups as upstream groups them, worst first

Changes, runs commands, according to the capabilities read.

The author describes the audit as six phases. README.md L9, README.md#L9 at the checked commit

What it can do, by group
Group	What it covers	Effect	On by default
Use bounded local evidence	Runs sandboxed local tests (function harness, existing unit test, parser fixture, isolated-loopback client) to resolve behavior when all execution controls are available. SKILL.md L144, skills/security-audit/SKILL.md#L144 at the checked commit	runs commands	no, optional
Findings and coverage-ledger validators	The parent runs validate-coverage-ledger.cjs after creating and after each update of the ledger, and validate-findings.cjs in Phase 4 and after every Phase 5 replacement. README.md L18, README.md#L18 at the checked commit	reads, runs commands	no, optional
Reconnaissance	Maps architecture, trust boundaries, input surfaces, prior evidence and deterministic coverage into architecture.md and coverage-ledger.json. README.md L11, README.md#L11 at the checked commit	reads, changes	no, optional
Structured output	Writes confirmed, needs_validation and rejected records to findings.json and checks them against report-schema.json. README.md L14, README.md#L14 at the checked commit	changes	no, optional
Target-neutral reporting	Derives REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md from the verified records and the coverage ledger. README.md L16, README.md#L16 at the checked commit	changes	no, optional
Guidance mode	Answers security questions, focused reviews and triage with the relevant parts of the skill, without audit artifacts; it may launch focused agents. SKILL.md L14, skills/security-audit/SKILL.md#L14 at the checked commit	reads	yes
Coverage-led hunting	Assigns isolated hunter agents to ledger units, records their checks and runs coverage-critic waves to find gaps. README.md L12, README.md#L12 at the checked commit	reads	no, optional
Candidate validation	Gives every unique candidate to a fresh verifier agent that tries to disprove it. README.md L13, README.md#L13 at the checked commit	reads	no, optional
Independent record verification	Fresh agents re-verify final source claims; a material replacement record goes to another independent verifier. README.md L15, README.md#L15 at the checked commit	reads	no, optional
ATTACK-CLASSES.md and domain companions	Attack classes from ATTACK-CLASSES.md selected for the application type, extended with application-specific classes from Phase 1 and split per subsystem for large codebases. ATTACK-CLASSES.md L5, skills/security-audit/ATTACK-CLASSES.md#L5 at the checked commit	reads	yes

Where it sends data and who can connect to it

No outside connection found in the files read.

Listens for no connections in the files read.

Other connections not ruled out: read in the documentation and the cited code, not searched in full.

How it runs generated from the files read, never drawn by hand

Markdown instructions the coding agent's model follows: a parent agent coordinates the run and owns shared state, and delegates through the platform's Task tool to research agents for source exploration and general agents for investigation and bounded local execution. SKILL.md L23-26, skills/security-audit/SKILL.md#L23-26 at the checked commit

Your AI client

Parts that live inside the AI client: skill instructions, client configuration.

SKILL.md SKILL.md holds setup, core principles, platform terminology, workflow overview and audit anti-patterns for the agent. README.md L28, README.md#L28 at the checked commit
Parent agent The parent agent coordinates the run and owns shared state. SKILL.md L23, skills/security-audit/SKILL.md#L23 at the checked commit

Your machine

Programs and files on the machine where you run the tool.

Output directory New writable directory outside the target, default ~/security-audit-skill/<repo-name>/run-<N>; inside the target only if the user picks a VCS-ignored path. SKILL.md L51, skills/security-audit/SKILL.md#L51 at the checked commit
validate-findings.cjs validate-findings.cjs, a zero-dependency validator for findings.json used in Phases 4 and 5. README.md L44, README.md#L44 at the checked commit
Target repository The repository under review, read by the agents for source inspection. SKILL.md L49, skills/security-audit/SKILL.md#L49 at the checked commit
OS-enforced sandbox User-provided OS-enforced sandbox in which target-controlled builds, tests and fixtures run. README.md L90, README.md#L90 at the checked commit

The six rights, read three waysThe six rights a tool can take (files, network, execution, secrets, persistence, approval), each read three ways and rated 0 to 3. 0 never means safe; “?” means no evidence. what the author says, what the code shows, what one lab run showed

Level 2 (open), read from the code. Not run in our lab yet.

Privilege Reach: six rights, each read three ways. Levels 0 to 3; ? means no evidence.
Right	Author sayswhat the author says	Code showswhat static analysis finds	Run showedwhat one lab run showed
Fileswhere does it read and write?
Networkwhom does it talk to?
Executionwhat does it run?
Secretswhich credentials does it touch?
Persistencewhat survives the run?
Approvaldoes it ask before acting?

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe · zero means: none declared (Declared), none found (Code), none observed (Lab)

Author says: the evidence

Files · 2README.md L84 author states the default output directory is under the user's home, outside the audited repository
Network · 0SKILL.md L42 author forbids probing deployed endpoints and external services
Execution · 2README.md L90 author states the workflow runs target-controlled builds and tests inside an OS sandbox
Secrets · 0SKILL.md L84 author forbids capturing the ambient environment or credential values
Persistence · 1README.md L22 author states runs are additive and reuse prior ledgers outside the target

Code shows: the evidence

Files · 2SKILL.md L51 write target is a new directory under the user's home, outside the audited repository
Network · 0none found: patterns net-v0.1 in 6 files at c1c8a8c
Execution · 2HUNTING.md L163 hunters run the target's own builds, tests and fuzzers, i.e. arbitrary target code
Secrets · 2ATTACK-CLASSES.md L118 the skill reads committed .env, credentials.json, .pem and .key files inside the audited repository to find hardcoded secrets: several secret files in the working directory (secrets 2, credential stores outside it would be 3)
Persistence · 1SKILL.md L96 later runs read the ledgers kept in earlier run directories outside the target
Approval · 0none found: patterns hitl-v0.1 in 6 files at c1c8a8c

Valid for commit c1c8a8c · checked 2026-10-19 · method reach-v0.1The published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.

Limits and risks what the files say that fits nowhere else, and what this reading does not cover

Without the sandbox controls the workflow keeps a lead as needs_validation instead of executing target code. README.md L90, README.md#L90 at the checked commit
A reconnaissance agent reports whether the local platform can enforce the sandbox controls; missing controls block target-controlled execution. RECONNAISSANCE.md L53, skills/security-audit/RECONNAISSANCE.md#L53 at the checked commit
The author reports that in their test runs a single run found roughly half of the vulnerabilities that repeated runs found in total. README.md L98, README.md#L98 at the checked commit
The obvious-things hunter checks the audited repository for committed .env, .env.local, credentials.json, *.pem and *.key files. ATTACK-CLASSES.md L118, skills/security-audit/ATTACK-CLASSES.md#L118 at the checked commit
The wildcard hunter is told to look at git history for reverted security fixes, commented-out auth checks and secrets committed then removed. ATTACK-CLASSES.md L103, skills/security-audit/ATTACK-CLASSES.md#L103 at the checked commit
In full audit mode the default output directory is in the user's home under ~/security-audit-skill/<repo-name>/run-<N>. README.md L84, README.md#L84 at the checked commit
Reproduction records keep allowlisted variable names and safe values; agents are told never to capture the ambient environment, credential values or authentication state. SKILL.md L84, skills/security-audit/SKILL.md#L84 at the checked commit
The author states that validator success proves format and ledger consistency, not the correctness of findings. VALIDATION-AND-REPORTING.md L118, skills/security-audit/VALIDATION-AND-REPORTING.md#L118 at the checked commit
In full audit mode the agent is told not to end the run until all Phase 6 artifacts are written and both validators pass, or an incomplete run status with its reason is recorded. SKILL.md L179, skills/security-audit/SKILL.md#L179 at the checked commit
A strict agent budget can still be exceeded by an unexpectedly large candidate set or by a material Phase 5 replacement that needs another independent verifier. SKILL.md L134, skills/security-audit/SKILL.md#L134 at the checked commit
When a request could mean guidance or full audit mode, the skill asks one focused question before creating files or starting the complete workflow. SKILL.md L17, skills/security-audit/SKILL.md#L17 at the checked commit
Reconnaissance reads the target and its local build and configuration state; it does not contact deployed endpoints, external identity providers, registries, brokers or cloud APIs. RECONNAISSANCE.md L5, skills/security-audit/RECONNAISSANCE.md#L5 at the checked commit
Agents may make a disposable copy of target source in their assigned scratch/ directory when a build must write beside source. SKILL.md L40, skills/security-audit/SKILL.md#L40 at the checked commit
Not covered: what it does at runtime. Other connections not ruled out: read in the documentation and the cited code, not searched in full.

What you need and what the documented installer does

What you need
Kind	What
AI client	Claude Code
Other	A coding agent whose model supports tool use and parallel sub-agents. README.md L88, README.md#L88 at the checked commit
Runtime	Node.js to run the findings and coverage-ledger validators. README.md L89, README.md#L89 at the checked commit
Operating system	OS-enforced sandbox (no external network, allowlisted env, resource limits, scratch-only writes) to run target code; without it leads stay needs_validation. README.md L90, README.md#L90 at the checked commit
Other tools	Target toolchains and dependencies must already be present locally; the skill tells agents not to install or fetch them. SKILL.md L40, skills/security-audit/SKILL.md#L40 at the checked commit

What the documented installer does

Installs with npx skills add pointed at the GitHub repository URL and --skill security-audit; the command pins neither the Skills CLI version nor a commit. README.md L53-56, README.md#L53-56 at the checked commit
Adding --global installs the skill at user level. README.md L58-64, README.md#L58-64 at the checked commit
Agent selection and non-interactive install options are documented in npx skills --help. README.md L66, README.md#L66 at the checked commit

Lab runs one run is an observation, not a benchmark

No lab run yet. Once we run it, this section shows what it did and whether it did more than it said.

About this entry

Type: Skill · Defensive · works with Claude Code
Source: github.com/cloudflare/security-audit-skill · skills/security-audit · MIT · manifest SKILL.md
Version readThe install command installs exactly the version we checked (the pinned git commit), so what you get is what the card describes.: c1c8a8c · last upstream push 2026-09-14 · no release since the pinned commit
In the catalog: listed · added 2026-10-19 · last checked 2026-10-19 · next check 2027-01-17 · fresh
ScannersA scan of the tool's files with a scanner for malicious patterns. “Pending” means it has not run yet.: cisco-skill-scanner: not run, pending
Changes: none since the entry was added on 2026-10-19
MethodThe published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.: v0.1 · reach-v0.1 · badge · the rules

Disagree?

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

This entry as Markdown as JSON

How this entry was checked, and how to cite it

Selected by the published criteria (method v0.1). What the author says comes only from author statements; what the code shows comes from the code and manifests at commit c1c8a8c, each with one evidence line. A “?” means no evidence, never zero; zero never means safe.

The descriptive profile (what it does, can do, how it runs, what it needs) was read through the same isolated pipeline at commit c1c8a8c on 2026-10-25: one reader proposed every fact with a quoted line, a script confirmed each quoted line (52 of 52), and a second reader checked each sentence against its lines. Where nothing was found, the page says so instead of assuming “none”.

Known issues and limits: remote server-side behaviour stays “?”; the lab is not your production; static analysis can miss runtime behaviour.

Placement, badges or fast tracks are not for sale. The author is employed by an IT consultancy; the company has no influence on selection, execution or result.

Cite this:

Ilja Schlak. "Cloudflare Security Audit Skill". Agentic Security Field Guide, checked 2026-10-19, method reach-v0.1. https://readbeforerun.ai/catalog/cloudflare-security-audit-skill/

The method · the rules

For maintainers

Badge for your README (reach 2 · not run yet):

[![reach 2 · not run yet](https://readbeforerun.ai/badge/cloudflare-security-audit-skill.svg)](https://readbeforerun.ai/catalog/cloudflare-security-audit-skill/)