security-audit — Skills — getagentictools

What it does

Task tool means the coding agent's delegation or sub-agent mechanism.

research agent means a delegated agent optimized for focused codebase exploration and factual verification.

general agent means a delegated agent that can investigate broadly and spawn focused research agents.

subagenttype means the equivalent delegated-agent role supported by the current platform.

Target: the codebase to audit (from the user's request or the current working directory)

architecture.md — Phase 1 output, fed into Phase 2 agent prompts

REPORT.md — human-readable report (Phase 4)

Requirements & configuration

Severity requires impact

3. Ignoring the deployment model. Rate limiting at the CDN layer is a valid architecture. Not every app needs application-level rate limiting.

6. "Potential" findings without proof. Either you can exploit it or you can't. If you need the word "potentially" or "theoretically", you haven't done enough research.

Configuration: REPORTFINDINGS

Source

Repository: https://github.com/cloudflare/security-audit-skill

security-audit FAQ

What does the security-audit skill do?

Security audit of a codebase — web apps, APIs, services, CLI tools, libraries, daemons, and more. Use when asked to find security bugs, do a security review, audit for vulnerabilities, or pen-test the code. Focuses on exploitable issues with real impact, not theoretical concerns or industry-standard behavior. Task tool means the coding agent's delegation or sub-agent mechanism. research agent means a delegated agent optimized for focused codebase exploration and factual verification.

What does security-audit require?

Severity requires impact 3. Ignoring the deployment model. Rate limiting at the CDN layer is a valid architecture. Not every app needs application-level rate limiting. 6. "Potential" findings without proof. Either you can exploit it or you can't. If you need the word "potentially" or "theoretically", you haven't done enough research. Configuration keys: REPORT, FINDINGS.

How do I install security-audit?

Run: npx -y skills add https://github.com/cloudflare/security-audit-skill --skill security-audit --agent claude-code — the source lives at github.com/cloudflare/security-audit-skill.

Maintain security-audit?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[security-audit on getagentictools](https://getagentictools.com/skills/cloudflare-security-audit-skill-security-audit?ref=badge)

npx agentictools info skills/cloudflare-security-audit-skill-security-audit

The second line is the CLI lookup for this page — handy in READMEs and docs.