C
cloudflare/security-audit-skill
A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings
View on GitHub ↗Link checked 2026-11-12 · HTTP 200 · opens the vendor's own site
Install & config
Client config (built from the install command this repo gives)
{
"mcpServers": {
"cloudflare-security-audit-skill": {
"command": "npx",
"args": ["skills"]
}
}
}Parsed from the README we fetched on 2026-10-27; we have not executed it.
command/args come from the install command the repository states. When it is ambiguous, the project README wins.
VS Code (.vscode/mcp.json - the key is servers)
{
"servers": {
"cloudflare-security-audit-skill": {
"command": "npx",
"args": ["skills"]
}
}
}Same server, but VS Code keeps it under <code>servers</code>.
Claude Code (command line)
claude mcp add --transport stdio cloudflare-security-audit-skill -- npx skills
Claude Code does not read a config file; add the server with this command.
Key names differ by client: Clients & CLI
- Star count
- 71,801 ★ · cloudflare/security-audit-skill · read from the GitHub search API · (checked 2026-11-13 20:00:50)
- Source
- read directly from its GitHub page · type: open-source project
- Harvest history
- first seen 2026-10-27 · last seen 2026-11-14 · seen 16× · listed by 1 sources
- Install
npx skills
FAQ (answers come from our records)
How do I install it?
The repository provides this install command:
npx skills. It comes from the repository itself; we cannot guarantee it runs as-is in your client.Who is it for?
We have no tags recorded for it yet.
Who maintains it?
repository
cloudflare/security-audit-skill；first catalogued 2026-10-27；last seen 2026-11-14。There is no official certification or quality rating here — we record sources and dates only.# security-audit
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.
This is the skill that seeded Cloudflare's vulnerability discovery harness, described in Build your own vulnerability harness. The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.
## What it does
The skill runs a structured audit in six phases:
1. Reconnaissance -- map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json.
2. Coverage-led hunting -- assign isolated hunters from ledger units, record their checks, and use coverage critics to find gaps.
3. Candidate validation -- give every unique candidate to a fresh verifier that tries to disprove it.
4. Structured output -- write confirmed, needsvalidation, and rejected records to findings.json and validate them against report-schema.json.
5. Independent record verification -- fresh agents verify final source claims. Material replacements receive another independent verifier.
6. Target-neutral reporting -- derive REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from the verified records and coverage ledger.
The parent runs validate-coverage-ledger.cjs after creating the ledger and after each later ledger update. It runs validate-findings.cjs in Phase 4 and again after every Phase 5 replacement.
The verdicts are distinct: confirmed has a complete source trace and bounded observed result, needsvalidation has an exact unresolved fact and no severity, and rejected records a disproved candidate.
Multiple runs against the same repo are additive. The skill uses prior ledgers and findings to target gaps, revalidate changed source, and carry forward current-source evidence without treating stale or unresolved work as covered.
## Files
| File | Purpose |
| SKILL.md | Setup, core principles, platform terminology, workflow overview, and audit anti-patterns |
| RECONNAISSANCE.md | Phase 1 reconnaissance prompts and synthesis instructions |
| HUNTING.md | Phase 2 orchestration, hunting methodology, and validation rules |
| ATTACK-CLASSES.md | Core, wildcard, and obvious-things attack prompts |
| MEMORY-SAFETY-AND-BINARY.md | Memory-safety, binary, and kernel hunting classes for native targets |
| AI-AND-LLM.md | Prompt-injection, agent/tool, and output-handling hunting classes for LLM-backed targets |
| WEB-PROTOCOL-AND-AUTH.md | HTTP request-framing, cache, and authentication-protocol hunting classes for HTTP-protocol and auth targets |
| CLIENT-SIDE.md | DOM-injection, messaging-trust, UI-redress, and prototype-pollution hunting classes for client-side/browser targets |
| SUPPLY-CHAIN-AND-RELEASE.md | Dependency, CI, release, signing, update, plugin, and extension hunting classes |
| CLOUD-AND-DEPLOYMENT.md | IAM, infrastructure-as-code, container, serverless, ingress, and runtime-configuration hunting classes |
| PROTOCOLS-RPC-AND-MESSAGING.md | RPC, serialization, queue, broker, webhook, and streaming-protocol hunting classes |
This is the skill that seeded Cloudflare's vulnerability discovery harness, described in Build your own vulnerability harness. The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.
## What it does
The skill runs a structured audit in six phases:
1. Reconnaissance -- map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json.
2. Coverage-led hunting -- assign isolated hunters from ledger units, record their checks, and use coverage critics to find gaps.
3. Candidate validation -- give every unique candidate to a fresh verifier that tries to disprove it.
4. Structured output -- write confirmed, needsvalidation, and rejected records to findings.json and validate them against report-schema.json.
5. Independent record verification -- fresh agents verify final source claims. Material replacements receive another independent verifier.
6. Target-neutral reporting -- derive REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from the verified records and coverage ledger.
The parent runs validate-coverage-ledger.cjs after creating the ledger and after each later ledger update. It runs validate-findings.cjs in Phase 4 and again after every Phase 5 replacement.
The verdicts are distinct: confirmed has a complete source trace and bounded observed result, needsvalidation has an exact unresolved fact and no severity, and rejected records a disproved candidate.
Multiple runs against the same repo are additive. The skill uses prior ledgers and findings to target gaps, revalidate changed source, and carry forward current-source evidence without treating stale or unresolved work as covered.
## Files
| File | Purpose |
| SKILL.md | Setup, core principles, platform terminology, workflow overview, and audit anti-patterns |
| RECONNAISSANCE.md | Phase 1 reconnaissance prompts and synthesis instructions |
| HUNTING.md | Phase 2 orchestration, hunting methodology, and validation rules |
| ATTACK-CLASSES.md | Core, wildcard, and obvious-things attack prompts |
| MEMORY-SAFETY-AND-BINARY.md | Memory-safety, binary, and kernel hunting classes for native targets |
| AI-AND-LLM.md | Prompt-injection, agent/tool, and output-handling hunting classes for LLM-backed targets |
| WEB-PROTOCOL-AND-AUTH.md | HTTP request-framing, cache, and authentication-protocol hunting classes for HTTP-protocol and auth targets |
| CLIENT-SIDE.md | DOM-injection, messaging-trust, UI-redress, and prototype-pollution hunting classes for client-side/browser targets |
| SUPPLY-CHAIN-AND-RELEASE.md | Dependency, CI, release, signing, update, plugin, and extension hunting classes |
| CLOUD-AND-DEPLOYMENT.md | IAM, infrastructure-as-code, container, serverless, ingress, and runtime-configuration hunting classes |
| PROTOCOLS-RPC-AND-MESSAGING.md | RPC, serialization, queue, broker, webhook, and streaming-protocol hunting classes |
Listed badge (optional)
Copy this line into the README if you want the listing mark. Optional, and it does not affect being listed.
[](https://anclum.com/en/s/cloudflare-security-audit-skill/)
- Source
- github · https://github.com/cloudflare/security-audit-skill
- Traction
- 71,801 ★
- added
- today