C
cloudflare/security-audit-skill
A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings
在 GitHub 查看 ↗链接已于 2026-11-12 核查 · HTTP 200 · 打开的是厂商自己的官网
安装与配置
客户端配置（取自该仓库的安装命令）
{
"mcpServers": {
"cloudflare-security-audit-skill": {
"command": "npx",
"args": ["skills"]
}
}
}解析自我们于 2026-10-27 抓取的该仓库 README；我们未执行过。
command/args 来自仓库写明的安装命令；不确定时请以该项目 README 为准。
VS Code（.vscode/mcp.json —— 键名是 servers）
{
"servers": {
"cloudflare-security-audit-skill": {
"command": "npx",
"args": ["skills"]
}
}
}VS Code 顶层键是 <code>servers</code>，其余与上面那份相同。
Claude Code（命令行）
claude mcp add --transport stdio cloudflare-security-audit-skill -- npx skills
Claude Code 不收 JSON 文件，用这条命令直接加。
配置项的键名以你的客户端为准：客户端与 CLI
- ★ 数取值
- 71,801 ★ · cloudflare/security-audit-skill · 取自 GitHub 搜索 API · （2026-11-13 20:00:50 核对）
- 来源明细
- 从该仓库的 GitHub 页面直接读取 · 条目类型：开源项目
- 收录与活跃
- 收录于 2026-10-27 · 最近见到 2026-11-14 · 共见到 16 次 · 被 1 个来源列出
- 安装
npx skills
常见问题（答案都来自我们的记录）
怎么安装？
该仓库给出的安装命令是
npx skills。我们的记录里它是仓库自己提供的；不保证在你的客户端上直接可用。它适合谁 / 用来做什么？
我们还没有为它记录标签。
谁维护它、还在更新吗？
仓库
cloudflare/security-audit-skill；我们收录于 2026-10-27；最近见到 2026-11-14。这里没有"官方认证"或"质量评级"——我们只记录来源与时间。# security-audit
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.
This is the skill that seeded Cloudflare's vulnerability discovery harness, described in Build your own vulnerability harness. The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.
## What it does
The skill runs a structured audit in six phases:
1. Reconnaissance -- map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json.
2. Coverage-led hunting -- assign isolated hunters from ledger units, record their checks, and use coverage critics to find gaps.
3. Candidate validation -- give every unique candidate to a fresh verifier that tries to disprove it.
4. Structured output -- write confirmed, needsvalidation, and rejected records to findings.json and validate them against report-schema.json.
5. Independent record verification -- fresh agents verify final source claims. Material replacements receive another independent verifier.
6. Target-neutral reporting -- derive REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from the verified records and coverage ledger.
The parent runs validate-coverage-ledger.cjs after creating the ledger and after each later ledger update. It runs validate-findings.cjs in Phase 4 and again after every Phase 5 replacement.
The verdicts are distinct: confirmed has a complete source trace and bounded observed result, needsvalidation has an exact unresolved fact and no severity, and rejected records a disproved candidate.
Multiple runs against the same repo are additive. The skill uses prior ledgers and findings to target gaps, revalidate changed source, and carry forward current-source evidence without treating stale or unresolved work as covered.
## Files
| File | Purpose |
| SKILL.md | Setup, core principles, platform terminology, workflow overview, and audit anti-patterns |
| RECONNAISSANCE.md | Phase 1 reconnaissance prompts and synthesis instructions |
| HUNTING.md | Phase 2 orchestration, hunting methodology, and validation rules |
| ATTACK-CLASSES.md | Core, wildcard, and obvious-things attack prompts |
| MEMORY-SAFETY-AND-BINARY.md | Memory-safety, binary, and kernel hunting classes for native targets |
| AI-AND-LLM.md | Prompt-injection, agent/tool, and output-handling hunting classes for LLM-backed targets |
| WEB-PROTOCOL-AND-AUTH.md | HTTP request-framing, cache, and authentication-protocol hunting classes for HTTP-protocol and auth targets |
| CLIENT-SIDE.md | DOM-injection, messaging-trust, UI-redress, and prototype-pollution hunting classes for client-side/browser targets |
| SUPPLY-CHAIN-AND-RELEASE.md | Dependency, CI, release, signing, update, plugin, and extension hunting classes |
| CLOUD-AND-DEPLOYMENT.md | IAM, infrastructure-as-code, container, serverless, ingress, and runtime-configuration hunting classes |
| PROTOCOLS-RPC-AND-MESSAGING.md | RPC, serialization, queue, broker, webhook, and streaming-protocol hunting classes |
This is the skill that seeded Cloudflare's vulnerability discovery harness, described in Build your own vulnerability harness. The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.
## What it does
The skill runs a structured audit in six phases:
1. Reconnaissance -- map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json.
2. Coverage-led hunting -- assign isolated hunters from ledger units, record their checks, and use coverage critics to find gaps.
3. Candidate validation -- give every unique candidate to a fresh verifier that tries to disprove it.
4. Structured output -- write confirmed, needsvalidation, and rejected records to findings.json and validate them against report-schema.json.
5. Independent record verification -- fresh agents verify final source claims. Material replacements receive another independent verifier.
6. Target-neutral reporting -- derive REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from the verified records and coverage ledger.
The parent runs validate-coverage-ledger.cjs after creating the ledger and after each later ledger update. It runs validate-findings.cjs in Phase 4 and again after every Phase 5 replacement.
The verdicts are distinct: confirmed has a complete source trace and bounded observed result, needsvalidation has an exact unresolved fact and no severity, and rejected records a disproved candidate.
Multiple runs against the same repo are additive. The skill uses prior ledgers and findings to target gaps, revalidate changed source, and carry forward current-source evidence without treating stale or unresolved work as covered.
## Files
| File | Purpose |
| SKILL.md | Setup, core principles, platform terminology, workflow overview, and audit anti-patterns |
| RECONNAISSANCE.md | Phase 1 reconnaissance prompts and synthesis instructions |
| HUNTING.md | Phase 2 orchestration, hunting methodology, and validation rules |
| ATTACK-CLASSES.md | Core, wildcard, and obvious-things attack prompts |
| MEMORY-SAFETY-AND-BINARY.md | Memory-safety, binary, and kernel hunting classes for native targets |
| AI-AND-LLM.md | Prompt-injection, agent/tool, and output-handling hunting classes for LLM-backed targets |
| WEB-PROTOCOL-AND-AUTH.md | HTTP request-framing, cache, and authentication-protocol hunting classes for HTTP-protocol and auth targets |
| CLIENT-SIDE.md | DOM-injection, messaging-trust, UI-redress, and prototype-pollution hunting classes for client-side/browser targets |
| SUPPLY-CHAIN-AND-RELEASE.md | Dependency, CI, release, signing, update, plugin, and extension hunting classes |
| CLOUD-AND-DEPLOYMENT.md | IAM, infrastructure-as-code, container, serverless, ingress, and runtime-configuration hunting classes |
| PROTOCOLS-RPC-AND-MESSAGING.md | RPC, serialization, queue, broker, webhook, and streaming-protocol hunting classes |
收录徽章（可选）
想把收录标记放进 README 就复制这行，可选，不影响收录。
[](https://anclum.com/zh/s/cloudflare-security-audit-skill/)
- 来源
- github · https://github.com/cloudflare/security-audit-skill
- Traction
- 71,801 ★
- 收录于
- 今天