repowisecloudflare/security-audit-skill

cloudflare / security-audit-skill

A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings

JavaScript★ 39,519
Use in your agentAsk this codebase

github.com/cloudflare/security-audit-skillIndexed at c1c8a8cUp to date with upstream

What is security-audit-skill?

security-audit-skill is a coding-agent skill for conducting multi-phase security audits of codebases. It coordinates reconnaissance, coverage-led hunting, candidate validation, structured findings, independent verification, and target-neutral reporting. The project is written in JavaScript and uses Node.js for its zero-dependency validators.

Written by a model from the README and the source

21 files and 119 symbols in 1 module, written in JavaScript.

Start reading

Code health

7.4out of 10Good

This codebase scores 7.4 out of 10 for code health, which we rate good. It also scores maintainability 6.1 and static performance 9.8 out of 10. The three are scored separately and never blended into one number. Risk is concentrated, as it usually is: 1 of 21 files are git hotspots, and they average 5.3 — which is where the fixes pay off most.

Full health report

Use cloudflare/security-audit-skill in your agent

Point Claude Code, Cursor, Codex or VS Code at this repository. Your agent gets the index this page is built from: cited answers, callers, history and health for any file.

  1. 1.In Claude, open Customize → Connectors, click +, then Add custom connector. On a Team or Enterprise plan an owner adds it first under Organization settings → Connectors.
  2. 2.Paste the server URL below as the Remote MCP server URL, then click Add.
  3. 3.Click Connect. A Repowise sign-in window opens. Approve access.
  4. 4.Repowise's tools are now available in your Claude chats.

Connect with one click. Sign in with Repowise (OAuth), no API key to copy. Works in Claude on the web, desktop, and mobile.

Docs
bash
https://api.repowise.dev/mcp/cloudflare/security-audit-skill
Editors need an API key: sign in to create one.Sign in to connect

This repo is public, so anyone with a Repowise account and an API key can connect.

Try asking

  • get_overview()
  • get_answer("how is security-audit-skill put together?")
  • get_why("why is security-audit-skill structured this way?")

Explore security-audit-skill

Key features of security-audit-skill

  • security-audit-skill runs audits through six phases from reconnaissance to target-neutral reporting.
  • security-audit-skill records confirmed, needs_validation, and rejected verdicts in structured findings.
  • security-audit-skill uses independent agents to validate candidates and verify final source claims.
  • security-audit-skill supports attack classes for LLM-backed, client-side, cloud, deployment, protocol, supply-chain, and other targets.
  • security-audit-skill uses coverage ledgers and prior findings to target gaps across repeated runs.

How cloudflare/security-audit-skill works

The workflow begins with reconnaissance that maps architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json. Coverage-led hunting assigns isolated hunters from ledger units and uses coverage critics to identify gaps. Candidate validation gives each unique candidate to a fresh verifier that attempts to disprove it. The findings are written to findings.json and checked against report-schema.json by skills/security-audit/validate-findings.cjs. Independent agents verify final source claims, and the verified records and coverage ledger produce REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md. skills/security-audit/AI-AND-LLM.md, skills/security-audit/CLIENT-SIDE.md, and skills/security-audit/CLOUD-AND-DEPLOYMENT.md provide attack classes for different target types.

The codebase has 21 files and 119 symbols in 1 module, led by JavaScript. Code health is 7.4 out of 10, rated good.

Getting started with security-audit-skill

  1. Start a coding agent in or pointed at the codebase to audit, then request an audit.
    security audit this codebase

Commands copied from the README

cloudflare/security-audit-skill FAQ

What is security-audit-skill?

security-audit-skill is a coding-agent skill that turns an agent into a security auditor. It coordinates reconnaissance, hunting, validation, structured findings, independent verification, and reporting.

How does security-audit-skill work?

security-audit-skill runs six phases that map the target, hunt by coverage units, validate candidates, verify records, and generate reports. Node.js validators check findings and coverage ledgers.

How do I install security-audit-skill?

security-audit-skill installs with the Skills CLI using npx skills add and the security-audit skill name. A global installation is also supported with the --global option.

What language is security-audit-skill written in?

security-audit-skill is written in JavaScript. Its zero-dependency findings and coverage-ledger validators run with Node.js.

How is the security-audit-skill code organized?

security-audit-skill is organized under skills, with workflow documents, attack-class guides, JSON schemas, validators, and validator tests. skills/security-audit/validate-findings.cjs validates findings.json.

When should I use security-audit-skill?

Use security-audit-skill when you want a coding agent to audit a codebase for security vulnerabilities. It supports full audit mode, focused vulnerability work, and security guidance requests.

What license does security-audit-skill use?

security-audit-skill uses the MIT license.

The summary, features and answers on this page are written by a model from the README and the source, and refreshed with each index.

About this page

Get a page like this for your own codebase

Repowise built this map of cloudflare/security-audit-skill from its source and git history. It parses every symbol, draws the dependency graph, scores each file's health from complexity, duplication, coverage and churn, finds hotspots and owners in the history, and writes documentation for every module. Your coding agent reads the same index over MCP, so its answers cite real files.

Index your repo freeSee how Repowise worksFree for 2 public repos, with a page like this one.

Prefer local? pip install repowise && repowise init indexes your own checkout, no account needed.