#4141st of 43 in Skills, plugins and rules
security-audit-skill
Coding-agent skill that runs a multi-phase security audit of a codebase
- Stars
- 29.1k
- License
- MIT
- Last commit
- Sep 2026
- Language
- JavaScript
Checked on GitHub.
Cloudflare is hiring: 435 open roles
Overview
A skill for coding agents that audits a repository for vulnerabilities in six phases: reconnaissance, hunting, candidate validation, structured output, record verification and reporting. Isolated sub-agents hunt from a coverage ledger, and a fresh agent tries to disprove each candidate. Results go to findings.json, checked by Node validators, and to REPORT.md. It is the single-repo starting point for Cloudflare's vulnerability harness.
Who it is for: Security engineers and developers auditing code with a coding agent
Strengths
- Separate agents find and validate each finding; verdicts are confirmed, needs_validation or rejected
- Zero-dependency Node validators check findings.json and coverage-ledger.json against a schema
- Attack-class prompts cover memory safety, web/auth, cloud, supply chain, client-side and LLM targets
- Repeated runs reuse prior ledgers and findings to target coverage gaps
Weaknesses
- Needs a model with tool use and parallel sub-agents; token cost is unknown
- Running target code requires an OS-enforced sandbox you must provide, else leads stay unvalidated
- README says a single run found roughly half of what repeated runs found
- No release published; install goes through the Skills CLI via npx
What it needs
- no GPU
- Needs Node.js, Skills CLI (npx skills), coding agent with parallel sub-agents, OS-enforced sandbox
- Models: any tool-use model with parallel sub-agents
Also in Skills, plugins and rules
See all 43| Rank | Project | Score |
|---|---|---|
| 1 | skillsAgent skills for planning, TDD, debugging and code review | 94 out of 100 |
| 2 | eccAgents, skills, hooks and rules bundle for Claude Code, Codex and other harnesses | 93 out of 100 |
| 3 | ponytailSkill prompt that makes coding agents write less code and add tests | 91 out of 100 |
| #4 | cavemanProxy and skill that cut token use in coding agents | 91 out of 100 |
| #5 | spec-kitCLI and agent skills for spec-driven development, bug fixing and idea assessment | 89 out of 100 |