Security Audit

A third-party skill from Cloudflare that finds security problems in codebases, APIs, services, CLI tools, libraries, and daemons. It reads the source first and looks for flaws that cross a real trust boundary. Each one comes with the evidence from the source, a safe way to reproduce it, a priority, and the smallest fix. By default it works in guidance mode. You can ask a security question, ask for a focused review, or get help triaging one finding. It doesn't write audit files or reports in that mode. It runs the full audit only when you clearly ask to audit or pen-test a codebase, ask for a full, comprehensive, or end-to-end review, or ask for report files. The full audit has six phases: reconnaissance, coverage-led hunting waves, candidate validation, structured output, independent record verification, and a report. Each finding is labeled confirmed, needs validation, or rejected. Only confirmed findings get a severity. It runs your code only inside a sandbox with no network access. If it can't enforce that sandbox, it doesn't run the code at all. It uses dummy data and doesn't probe live systems. Cloudflare licenses it under MIT.

This skill hasn't been reviewed yet.