Skill Finder
security-audit vs security-and-hardening
Pick security-audit when you want existing source code reviewed for real flaws, from one question up to a full audit report; pick security-and-hardening when you want security rules applied while Claude writes web code. security-audit scores 80 with 74,464 installs, and security-and-hardening scores 77 with 76,087.
| security-auditby Cloudflare | security-and-hardeningby Addy Osmani | |
|---|---|---|
| Best for | For developers who want a source-based security review, from one question up to a full multi-agent audit. Skip it if you want scans of live deployed sites. | For web developers handling input, logins or personal data who want clear always, ask-first and never rules. Skip it if you need a formal audit report. |
| Score | 81 | 77 |
| Rank | #47 | #87 |
| Security scans | Scanners disagree | Scanners disagree |
| Installs | 72,383 | 82,658 |
| Repository stars | 69,753 | 115,385 |
| Last repository change | Sep 14, 2026 | Nov 1, 2026 |
| Tokens when used | about 5,396 | about 4,224 |
| You need | Node.js for the bundled validators in full audits, An OS sandbox if target code must be run | Nothing extra |
| License | MIT | MIT |
| Install | npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit | npx skills add https://github.com/addyosmani/agent-skills --skill security-and-hardening |
How do they differ?
security-audit, from Cloudflare, gives guidance by default. A full audit starts only when you ask and runs six phases, from reconnaissance and subagent hunting waves to a validated findings.json and a REPORT.md. Output goes to a folder outside the repo, and target code runs only in a sandbox with no network.
security-and-hardening, from Addy Osmani, opens with a short STRIDE threat model, then sorts its rules into always, ask first and never. Examples are parameterized queries, asking before CORS changes, and never passing user data to eval. It closes with a verification checklist.
Which should you install?
security-audit needs Node.js for its validators in full audits, and an OS sandbox if target code must run. It reads your source, starts subagents and writes audit files outside the repo. security-and-hardening needs nothing extra; it edits project code and runs your package manager's audit command.
Skip security-audit if you need probes against live endpoints. Skip security-and-hardening if you need a full audit with findings files.