Menu

#31 by GitHub stars

cloudflare/security-audit-skill

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/compr

SecurityEngineering

History

Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.

View weekly changes

skills/security-audit/SKILL.md

Week of Nov 2, 2026 · +0 / −0 lines

Before Network or broad shell → After Network or broad shell

c1c8a8c14710 → c1c8a8c14710

Compare on GitHub

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → c1c8a8c14710

No earlier version was observed for comparison.

Compare on GitHub

View on GitHubAdd to my skills

Verified commit c1c8a8c1471069fb0e188eeaff69b8e8db6564a8

63.5kGitHub stars
9.4kstars in 7 days
1skill in this repository
0commits in 30 days

Heat

7.3
  • Star growth, last 7 daysAhead of 99% of tracked repositories
  • Star growth, last 24 hoursAhead of 100% of tracked repositories
  • Rank movement, last 7 daysAhead of 89% of tracked repositories
  • Commits, last 30 daysAhead of 0% of tracked repositories
  • Accounts asking about it through MCP, last 7 daysNot available
  • Hot votes this weekAhead of 0% of tracked repositories

Heat never changes the order by stars, and sponsorship never touches it. How heat works

Stars over time

Aug 2, 2026Nov 6, 202663,482

Individual skills in this repository

How it works

security-audit

When your agent uses it

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.

What it loads into context

Frontmatter

76 tokens

Always available to the agent

SKILL.md

4,447 tokens

When the skill is activated

Reference documents

31,739 tokens

Loaded on request

Token counts are estimates. Scripts run separately; they are not counted as reference context.

The playbook

  1. Operating modes
  2. Platform terminology
  3. Universal execution safety
  4. Full audit setup
  5. Full audit planning
  6. Core principles
  7. Full audit workflow
  8. Anti-patterns

Scripts executed separately

  • validate-coverage-ledger.cjs
  • validate-coverage-ledger.test.cjs
  • validate-findings.cjs
  • validate-findings.test.cjs

Files

  • AI-AND-LLM.mddoc10,617 bytes
  • ATTACK-CLASSES.mddoc15,695 bytes
  • CLIENT-SIDE.mddoc8,594 bytes
  • CLOUD-AND-DEPLOYMENT.mddoc8,291 bytes
  • DATA-ISOLATION-AND-LIFECYCLE.mddoc7,798 bytes
  • DESKTOP-MOBILE-AND-LOCAL-IPC.mddoc8,739 bytes
  • HUNTING.mddoc22,446 bytes
  • MEMORY-SAFETY-AND-BINARY.mddoc10,513 bytes
  • PROTOCOLS-RPC-AND-MESSAGING.mddoc7,483 bytes
  • RECONNAISSANCE.mddoc15,902 bytes
  • RESOURCE-EXHAUSTION-AND-AVAILABILITY.mddoc7,476 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SKILL.mdcore22,026 bytes
  • SUPPLY-CHAIN-AND-RELEASE.mddoc7,258 bytes
  • VALIDATION-AND-REPORTING.mddoc17,843 bytes
  • WEB-PROTOCOL-AND-AUTH.mddoc12,300 bytes
  • report-schema.jsonasset14,494 bytes
  • validate-coverage-ledger.cjsruns33,522 bytes
  • validate-coverage-ledger.test.cjsruns28,483 bytes
  • validate-findings.cjsruns28,806 bytes
  • validate-findings.test.cjsruns26,384 bytes
Read SKILL.md

# Security Audit

Find vulnerabilities that violate a real trust boundary, then give owners the source evidence, safe reproduction, priority, and smallest effective fix. This is a defensive, source-first workflow. A candidate without a concrete affected principal, resource, or security outcome is not a confirmed finding.

## Operating modes

This skill is guidance by default. Loading it does not authorize the complete audit workflow or file creation.

- **Guidance mode**: For security questions, focused reviews, methodology, triage, or investigation of specific findings, use only the relevant parts of this skill. Do not automatically run all six phases, create an output directory, or write audit artifacts. You may launch focused agents when useful; they return results to the current task.
- **Full audit mode**: Use the complete workflow when the user explicitly asks to audit or pen-test a codebase, asks for a full, comprehensive, or end-to-end security review, or requests report artifacts. Run all six phases and write the files defined below.

If the request could mean either mode, ask one focused question before creating files or starting the complete workflow.

## Platform terminology
View the complete source on GitHub

Skills included

  • security-audit

Repository facts

License
MIT
Created
Jun 18, 2026
Last pushed
Sep 14, 2026
Forks
4,005
Open issues
42
Project activity
Active

Rank over the last 12 weeks

Now #31 · best #31 · up 45 in 30 days

  1. #37 from Oct 28 to Oct 29
  2. #36 on Oct 30
  3. #35 on Oct 31
  4. #34 from Nov 1 to Nov 3
  5. #33 on Nov 4
  6. #31 since Nov 5
71 earlier periods
  1. #293 on Aug 2
  2. #297 on Aug 7
  3. #299 on Aug 8
  4. #294 on Aug 9
  5. #301 on Aug 10
  6. #296 on Aug 11
  7. #295 on Aug 12
  8. #300 on Aug 13
  9. #297 on Aug 14
  10. #295 on Aug 15
  11. #299 on Aug 16
  12. #297 on Aug 17
  13. #303 on Aug 18
  14. #301 on Aug 19
  15. #292 on Aug 20
  16. #293 on Aug 21
  17. #288 on Aug 22
  18. #295 on Aug 23
  19. #297 on Aug 24
  20. #298 on Aug 25
  21. #296 on Aug 26
  22. #289 on Aug 27
  23. #291 on Aug 28
  24. #289 on Aug 29
  25. #283 on Aug 30
  26. #290 on Aug 31
  27. #291 on Sep 1
  28. #290 on Sep 2
  29. #297 on Sep 3
  30. #288 on Sep 4
  31. #286 on Sep 5
  32. #287 on Sep 6
  33. #295 on Sep 7
  34. #294 on Sep 8
  35. #296 on Sep 9
  36. #295 on Sep 10
  37. #292 on Sep 11
  38. #299 on Sep 12
  39. #300 on Sep 13
  40. #248 on Sep 14
  41. #230 on Sep 15
  42. #159 on Sep 16
  43. #120 on Sep 17
  44. #108 on Sep 18
  45. #98 on Sep 19
  46. #89 on Sep 20
  47. #87 on Sep 21
  48. #85 on Sep 22
  49. #84 on Sep 23
  50. #83 from Sep 24 to Sep 25
  51. #82 from Sep 26 to Sep 28
  52. #81 from Sep 29 to Oct 4
  53. #79 on Oct 5
  54. #78 on Oct 6
  55. #76 on Oct 7
  56. #75 on Oct 8
  57. #74 on Oct 9
  58. #71 on Oct 10
  59. #68 on Oct 11
  60. #66 from Oct 12 to Oct 14
  61. #67 on Oct 15
  62. #66 on Oct 16
  63. #63 on Oct 17
  64. #62 on Oct 18
  65. #58 on Oct 19
  66. #57 on Oct 20
  67. #52 on Oct 21
  68. #51 on Oct 22
  69. #47 on Oct 23
  70. #42 on Oct 24
  71. #44 on Oct 25

Before you install

Network or broad shell

Automated signals, not a guarantee

Checked Nov 2, 2026

Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.

Show 20 notes
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • skills/security-audit/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
Show all 10 signals by file

skills/security-audit/ATTACK-CLASSES.md

  • Dangerous shell operationline 121
    - Are there any `eval()`, `exec()`, `child_process`, `Function()`, `vm.runInContext`, `import()` with dynamic input?

skills/security-audit/DESKTOP-MOBILE-AND-LOCAL-IPC.md

  • Access to secretsline 15
    [Credential-related source omitted]
  • Access to secretsline 67
    [Credential-related source omitted]

skills/security-audit/WEB-PROTOCOL-AND-AUTH.md

  • Access to secretsline 39
    [Credential-related source omitted]
  • Access to secretsline 100
    [Credential-related source omitted]
  • Access to secretsline 103
    [Credential-related source omitted]

skills/security-audit/validate-coverage-ledger.cjs

  • Executable scriptline 1
    #!/usr/bin/env node

skills/security-audit/validate-coverage-ledger.test.cjs

  • Executable scriptline 1
    Executable file

skills/security-audit/validate-findings.cjs

  • Executable scriptline 1
    #!/usr/bin/env node

skills/security-audit/validate-findings.test.cjs

  • Executable scriptline 1
    Executable file

How the signals fit together

Facts from a static read of the files at the pinned commit. They describe what the code does, not why.

Signal confidence: 10 facts

Works with

Agent compatibility, from the files in this repository
AgentStatusEvidenceInstall to
Claude CodeCompatibleStandard SKILL.md skills/security-audit/SKILL.md.claude/skills/<skill-name>/
CodexCompatibleStandard SKILL.md skills/security-audit/SKILL.md.agents/skills/<skill-name>/
CursorCompatibleStandard SKILL.md skills/security-audit/SKILL.md.cursor/skills/<skill-name>/
Gemini CLICompatibleStandard SKILL.md skills/security-audit/SKILL.md.gemini/skills/<skill-name>/
GitHub CopilotCompatibleStandard SKILL.md skills/security-audit/SKILL.md.github/skills/<skill-name>/
OpenCodeCompatibleStandard SKILL.md skills/security-audit/SKILL.md.opencode/skills/<skill-name>/
  • Native The repository ships a manifest, folder or frontmatter field for this agent.
  • Compatible A standard SKILL.md that this agent can read.
  • Unknown No evidence either way.

Derived automatically from paths, manifests and frontmatter. Not tested on each agent.

You might also use

mukul975/Anthropic-Cybersecurity-Skills

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io …

35.7kGitHub stars

Tencent/AI-Infra-Guard

A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.

7.4kGitHub stars

snyk/agent-scan

Security scanner for AI agents, MCP servers and agent skills.

3.2kGitHub stars

prompt-security/clawsec

A complete security skill suite for OpenClaw, Hermes, PicoClaw and NanoClaw agents (and variants). Protect your SOUL.md (etc') with drift detection, live security recommendations,…

1.1kGitHub stars

mattpocock/skills

Skills for Real Engineers. Straight from my .agents directory.

316.5kGitHub stars

obra/superpowers

An agentic skills framework & software development methodology that works.

313.5kGitHub stars

Explore alternatives and comparisons

Add this badge to your README

It updates every night and links to this page.

cloudflare/security-audit-skill: #31 on hotskills, 63.5k stars

[![cloudflare/security-audit-skill on hotskills](https://hotskills.dev/badge/cloudflare-security-audit-skill.svg)](https://hotskills.dev/skill/cloudflare-security-audit-skill/)