PluginStackCloudflare Security Audit Skill
Cloudflare Security Audit Skill official site ↗Last checked against the official docs:
What it does
An agent skill from Cloudflare that runs a structured security audit of a codebase instead of a one-shot "look for bugs" prompt. It works in phases: map the architecture and keep a coverage ledger, hunt for issues area by area, have a fresh sub-agent try to validate each candidate, write findings as JSON checked against a schema (confirmed, needs validation or rejected), verify each record again, then produce a written report. Cloudflare says it grew out of the internal vulnerability harness described on its blog in June 2026. It is a single skill (security-audit), MIT licensed.
How an audit runs
- Recon: the agent maps the architecture (architecture.md) and starts a coverage ledger (coverage-ledger.json) so it can track what it has looked at.
- Hunting: it works through the code area by area, guided by the ledger.
- Validation: each candidate goes to a fresh verifier sub-agent that tries to confirm or reject it.
- Structured output: findings are written to findings.json and checked against the bundled report-schema.json, each marked confirmed, needs_validation or rejected.
- Verification and reporting: every record is checked again before the Markdown reports are written.
Things to know before you run it
The skill has two modes. Asking it to audit or pen-test a codebase runs the full audit with report files. Security questions and focused work on one issue use a lighter guidance mode unless you ask for the report artifacts.
Validation is only as strong as your sandbox. To execute the target's builds, tests or fixtures, the README asks for an OS-enforced sandbox with no external network, a clean environment, resource limits and writes limited to scratch folders. Without that, candidates stay as needs_validation instead of being run.
Who it's for
Developers and security reviewers who use Claude Code, Codex or another skills-capable agent and want a repeatable audit with evidence for each finding, rather than a list of guesses.
How to set it up
Install it into the current project with the open skills CLI (run from the project root). Add --global to install it for your user instead:
bashnpx skills add https://github.com/cloudflare/security-audit-skill --skill security-auditCheck the requirements first. The README asks for an agent whose model supports tool use and parallel sub-agents, Node.js for the bundled validators, and an OS-enforced sandbox for running any of the target's code. Without the sandbox, leads stay marked as needing validation instead of being confirmed.
Restart your agent so it picks up the skill, then ask for an audit in plain language. Output goes to ~/security-audit-skill/<repo-name>/run-<N> unless you name another folder. Each run writes REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md plus the JSON findings.
Treat the report as a starting point for human review. A full audit uses many sub-agent calls, so it can take a while and use a lot of tokens on a large repository.
Check the official Cloudflare Security Audit Skill docs for the latest steps.
Frequently asked questions
Which agents can use it?
Any coding agent that supports Agent Skills, with a model that can use tools and run parallel sub-agents. You install it with the open skills CLI, which supports agents such as Claude Code, Codex, Cursor and OpenCode.
Is it free?
Yes. The skill is MIT licensed. You pay only for the model usage of the agent you run it in.
Related guides
Example prompts
Security audit this codebase.Find security vulnerabilities in ./src.Do a security review of this repo and write the output to ~/audits/my-project.Made Cloudflare Security Audit Skill? Add the badge
If you like, show that Cloudflare Security Audit Skill is listed and hand-checked here. It's optional: listings are free and we never ask for a link back.
Get the Markdown or HTML
Markdown (for a GitHub README)
[](https://www.pluginstackai.com/plugins/cloudflare-security-audit-skill/)HTML (for a website)
<a href="https://www.pluginstackai.com/plugins/cloudflare-security-audit-skill/"><img src="https://www.pluginstackai.com/badge/hand-checked.svg" alt="Hand-checked on PluginStack" width="226" height="28"></a>Free: MCP Starter Checklist
After you set this tool up, use the one-page checklist so your next MCP server doesn't fail on first connect.
More Rules & Prompts
- Anthropic
Agent Skills (Anthropic)
Anthropic's public repository of Agent Skills: folders with a SKILL.md file (plus optional scripts and resources) that Claude loads when a task needs them. It includes example skills, the document skills behind Claude's file creation, a skill template and a copy of the Agent Skills spec (the open standard lives at agentskills.io). Many skills are Apache-2.0; the document skills are source-available, not open source.
- Agentic AI Foundation (Linux Foundation)
AGENTS.md
A simple open format for giving coding agents project instructions: one AGENTS.md markdown file in your repo with setup commands, test steps and code style. It is now stewarded by the Agentic AI Foundation under the Linux Foundation, and the agents.md site lists many tools that read it, including Codex, Cursor, goose, OpenCode, Aider, Zed, Kilo Code and GitHub Copilot's coding agent. The site and repo are MIT licensed. Claude Code reads it too when a project has no CLAUDE.md.
- Google (Android)
Android Skills
Google's official Agent Skills for Android development: SKILL.md instructions that ground coding agents in current Android guidance for tasks where Google's evaluations show LLMs underperform. Examples include migrating XML views to Jetpack Compose, upgrading to AGP 9, setting up Navigation 3, making an app edge-to-edge, auditing R8 configuration and fixing ANRs. They follow the open Agent Skills standard, so they work with Claude Code, Codex, Gemini/Antigravity and other agents that support skills. Apache-2.0.
- Anthropic
Anthropic Knowledge Work Plugins
Anthropic's open-source set of role plugins built for Claude Cowork that also install in Claude Code. Each plugin bundles slash commands, skills and connector (MCP) settings for one kind of work: sales, finance, data, legal, marketing, customer support, product management, engineering, design, HR, operations, bio research, small business and more. Plugins are plain Markdown and JSON, so you can read and edit them, or fork one as a template for your own team. The repository's marketplace also lists plugins from partners. Apache-2.0.
- Anthropic
Claude Code Plugins (official marketplace)
Anthropic's official plugin marketplace for Claude Code. A plugin bundles skills, subagents, hooks and MCP or LSP servers so you install them in one step. It lists plugins Anthropic maintains (such as commit-commands, code-review, feature-dev and the language-server plugins) alongside plugins from partners and other authors. Claude Code adds this marketplace for you the first time you start an interactive terminal session. The repo is Apache-2.0; each plugin has its own license.
- Cursor
Cursor Plugins (official)
Cursor's plugin specification and its official plugins. A Cursor plugin packages rules, skills, subagents, commands, MCP servers and hooks into one install. The repo holds Cursor-made plugins (such as Create Plugin, Advisor and Orchestrate) plus Cursor-packaged integrations for tools like GitHub, Playwright, Gmail, Google Drive, HubSpot and Salesforce. Cursor says every plugin in its Marketplace is manually reviewed before it's listed and must be open source. Plugins in the repo are MIT licensed.