security-audit: a Claude Code skill by Cloudflare

Official

For developers who want a source-based security review, from one question up to a full multi-agent audit. Skip it if you want scans of live deployed sites.

Copy install command View the source

Score: 81of 100
Rank: #47of 239
Installs: 72.4Kon skills.sh
Security: Mixed 3 scanners
Updated: Sep 142026
Context: ~93tokens always

Install

npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

Run it in your terminal. View the source

Using the Claude app rather than Claude Code? You can add a skill there too. How to add it in the app

What does security-audit do?

security-audit is a Claude skill from Cloudflare that looks for flaws crossing a real trust boundary in a codebase, API, CLI tool, library or daemon. By default it only gives guidance for questions and focused reviews. A full audit starts only when you ask for one and runs six phases: reconnaissance, hunting waves by subagents, fresh checks of each candidate, findings.json validated against a schema, independent re-checks, and a REPORT.md with detail files. Output goes outside the repo, to ~/security-audit-skill/<repo>/run-N by default. It reads source only, and runs target code only inside a sandbox with no network. Runs can be quick, standard or deep.

When should you use security-audit?

Use it when

Asking whether a specific handler can be exploited
Running a full audit before a major release
Checking the diff between two commits for new flaws

Skip it when

You need probes against live endpoints or services
You want a short checklist, not a long multi-agent run

What it needs and what it can touch

You need

Node.js for the bundled validators in full audits
An OS sandbox if target code must be run

What it can do

Reads your source code
Starts subagents to hunt and verify findings
Writes audit files to a folder outside the repo

From reading its instructions, not from running it.

Why it scores 81

Strongest on quality (100 of 100), weakest on adoption (64).

Adoption35 points 64
Upkeep20 points 80
Trust20 points 95
Quality15 points 100
Reader answers10 points Not enough answers yet, so this does not count

How the formula works

Is security-audit safe to install?

At least one scanner raised a medium warning. Read the results below. Scanners often miss what other scanners catch, and a skill can change after a scan. Read its source before you install it.

Scanner	Result	Date
Gen Agent Trust Hub	Passed	Sep 15, 2026
Socket	Passed	Sep 15, 2026
Snyk	Medium risk	Sep 15, 2026

Details

Installs: 72,383
Repository stars: 69,753
Last repository change: Sep 14, 2026
Tokens always loaded: about 93
Tokens when used: about 5,396
License: MIT
Data confidence: High

Side-by-side comparisons

security-audit vs security-and-hardening

Alternatives to security-audit

All skills for this job

security-review

For developers who want a security review of a file or diff that reports only confirmed, exploitable flaws.

Score 74 23.2K installs Official High-risk warning

Get security-review
ponytail-audit

For developers or founders who want a whole repo audited in plain English and ranked by risk.

Score 74 56.6K installs

Get ponytail-audit
penetration-testing-with-strix

For developers who want automated pentests that prove each finding with a working exploit.

Score 73 20.5K installs Official High-risk warning

Get penetration-testing-with-strix
code-review-and-quality

For developers who want a structured review of a diff or pull request before merging.

Score 77 85.2K installs

Get code-review-and-quality