Directory › Security › security-audit (Cloudflare)
> GEM SECURITY · DEVELOPMENT · AGENTS & AUTOMATION · AGENT SKILLS
security-audit (Cloudflare)
by Cloudflare
A skill for your coding assistant that audits your project's security in six phases, with a different agent trying to disprove every flaw it finds.
View on GitHub →What it does
- Six phases: reconnaissance, hunting, validation, structured output, independent verification, report
- Each finding is challenged by a different agent: only those that hold up are confirmed
- MIT license, from Cloudflare; you need a coding assistant and a sandbox to run tests
! Not tested by HelloPixDig. Information from the official README and MIT license (October 20, 2026). Defensive tool: use it on your own code or with the owner's permission. Without a sandbox, leads that need code execution stay “needs validation”. The README says a single run finds roughly half of what repeated runs find, so an audit is never a guarantee.
Install it
Requirements: Node.js, a coding assistant with tools and sub-agents, and a sandbox (no network) for any code that runs.
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-auditsecurity audit this codebase
The prompt for your agent
Paste it into your coding agent: it checks the requirements and installs it for you.
Install security-audit (Cloudflare) (https://github.com/cloudflare/security-audit-skill) on my machine.
1. Check the requirements: Node.js, a coding assistant with tools and sub-agents, and a sandbox (no network) for any code that runs. If anything is missing, tell me before installing anything.
2. Follow the official method:
- Install the skill: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit
- In your coding assistant: security audit this codebase
3. Check that it works, then explain how to launch it and where to start.
Always review what your agent is about to run, especially install commands.