Premium Coding

Security Audit skill

A careful, source-first security review of a codebase with evidence and fixes.

A Premium skill. Premium opens soon.

By: Cloudflare
Licence: MIT
Installs: 39.2K
Works in: 17 apps

Security Audit

Find vulnerabilities that violate a real trust boundary, then give owners the source evidence, safe reproduction, priority, and smallest effective fix. This is a defensive, source-first workflow. A candidate without a concrete affected principal, resource, or security outcome is not a confirmed finding.

Operating modes

This skill is guidance by default. Loading it does not authorize the complete audit workflow or file creation.

Guidance mode: For security questions, focused reviews, methodology, triage, or investigation of specific findings, use only the relevant parts of this skill. Do not automatically run all six phases, create an output directory, or write audit artifacts. You may launch focused agents when useful; they return results to the current task.

Full audit mode: Use the complete workflow when the user explicitly asks to audit or pen-test a codebase, asks for a full, comprehensive, or end-to-end security review, or requests report artifacts. Run all six phases and write the files defined below.

If the request could mean either mode, ask one focused question before creating files or starting the complete workflow.

Platform terminology

This skill is agent-neutral:

Parent is the agent that coordinates the run and owns shared state.

Task tool is the platform's delegation or sub-agent mechanism.

research agent is a delegated agent for focused source exploration and factual verification.

general agent is a delegated agent for broad investigation and bounded local execution.

subagent_type: in a heading names which of these two delegated agent roles runs that work.

Use equivalent platform capabilities while preserving role, write-isolation, prompt, and independence boundaries.

Universal execution safety

These rules apply in both operating modes. Source inspection is read-only. Run target-controlled builds, tests, processes, browsers, emulators, fuzzers, and fixture processing only inside an OS-enforced sandbox that provides all of these controls:

no external network; use only an isolated loopback namespace when the check needs local client/server traffic;

No example output yet, so this is the start of the skill’s own instructions.

What Security Audit makes

Reviews code for real security holes. It only counts a problem as confirmed when it can show who is affected and what could go wrong, so you get fewer false alarms.

It works in two modes. In guidance mode it answers security questions and reviews specific code. In full audit mode, which you must ask for, it runs a six-phase review and writes report files with evidence, how to reproduce safely, priority and the smallest fix. Safety rules keep it from touching live systems.

Best for: Developers and small teams who want a defensive security review they can trust.

Guidance mode by default, full audit only on request
Six-phase audit with written reports
Each finding comes with evidence, priority and a small fix
Strict safety rules: sandboxed runs, dummy data, no live probing

Example prompts

Type something like this once the skill is added. Your app opens the skill when the request matches.

Do a full security audit of this repository
Is this login code safe?
Review the API routes for authorization problems
Triage these scanner findings and tell me which are real

What’s inside

21 files in the skill folder, with its MIT licence kept inside. 4 are program files your agent can run. Read them before you install.

SKILL.md the instructions
AI-AND-LLM.md
ATTACK-CLASSES.md
CLIENT-SIDE.md
CLOUD-AND-DEPLOYMENT.md
DATA-ISOLATION-AND-LIFECYCLE.md
DESKTOP-MOBILE-AND-LOCAL-IPC.md
HUNTING.md
LICENSE licence
MEMORY-SAFETY-AND-BINARY.md
PROTOCOLS-RPC-AND-MESSAGING.md
RECONNAISSANCE.md
report-schema.json
RESOURCE-EXHAUSTION-AND-AVAILABILITY.md
and 7 more

Which apps it works in

A skill is a folder of plain files, so any app that reads the open skills format can use it. Pick your app for its page.

How to add Security Audit to your app

Step by step for each app. We say where to click, so you never need to leave this page.

ChatGPTby OpenAI

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Open the ChatGPT desktop app and look for Skills in the sidebar, where standalone skills are listed.
3 Add the “security-audit” folder there if your version offers it. If you do not see Skills yet, use this skill in Claude or Codex instead.
4 In a chat, type @ and pick the skill, or just ask. Ask for what you want, for example: “Do a full security audit of this repository”

To make your own, describe the workflow to @skill-creator in ChatGPT Work and it drafts a skill for you.

More ChatGPT skills

Claude appby Anthropic

1 Download the skill (.zip) with the button at the top of this page.
2 In the Claude app, open Settings > Features.
3 Upload the .zip file.
4 Ask for what you want, for example: “Do a full security audit of this repository”

The current Claude Help Center lists Free, Pro, Max, Team and Enterprise. Organization policy can restrict uploads and sharing. Chat runs code in an isolated environment; uploading a skill does not give it your local project, coding-agent tools or unrestricted network access.

More Claude app skills

Codexby OpenAI

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-audit” folder into your skills folder:~/.agents/skills
3 Or paste the install prompt below into Codex and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Do a full security audit of this repository”

Install prompt: paste this into Codex

I downloaded the agent skill "Security Audit" as security-audit.zip. Unzip it and copy the security-audit folder into ~/.agents/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .agents/skills inside that project instead.

More Codex skills

Claude Codeby Anthropic

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-audit” folder into your skills folder:~/.claude/skills
3 Or paste the install prompt below into Claude Code and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Do a full security audit of this repository”

Install prompt: paste this into Claude Code

I downloaded the agent skill "Security Audit" as security-audit.zip. Unzip it and copy the security-audit folder into ~/.claude/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: claude plugin marketplace add <owner/repo>

Built-in installer: claude plugin install <plugin>@<marketplace>

To use the skill in one project only, put it in .claude/skills inside that project instead.

More Claude Code skills

Cursor

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-audit” folder into your skills folder:~/.cursor/skills
3 Or paste the install prompt below into Cursor and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Do a full security audit of this repository”

Install prompt: paste this into Cursor

I downloaded the agent skill "Security Audit" as security-audit.zip. Unzip it and copy the security-audit folder into ~/.cursor/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .cursor/skills inside that project instead. Cursor also reads ~/.agents/skills, ~/.claude/skills, ~/.codex/skills.

More Cursor skills

GitHub Copilotby GitHub

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-audit” folder into your skills folder:~/.copilot/skills
3 Or paste the install prompt below into GitHub Copilot and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Do a full security audit of this repository”

Install prompt: paste this into GitHub Copilot

I downloaded the agent skill "Security Audit" as security-audit.zip. Unzip it and copy the security-audit folder into ~/.copilot/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: gh skill install <owner/repo> <skill> --agent github-copilot --scope user

To use the skill in one project only, put it in .github/skills inside that project instead. GitHub Copilot also reads ~/.agents/skills.

More GitHub Copilot skills

Gemini CLIby Google

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-audit” folder into your skills folder:~/.gemini/skills
3 Or paste the install prompt below into Gemini CLI and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Do a full security audit of this repository”

Install prompt: paste this into Gemini CLI

I downloaded the agent skill "Security Audit" as security-audit.zip. Unzip it and copy the security-audit folder into ~/.gemini/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: gemini skills install <git-url>

To use the skill in one project only, put it in .gemini/skills inside that project instead. Gemini CLI also reads ~/.agents/skills.

More Gemini CLI skills

Windsurf

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-audit” folder into your skills folder:~/.codeium/windsurf/skills
3 Or paste the install prompt below into Windsurf and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Do a full security audit of this repository”

Install prompt: paste this into Windsurf

I downloaded the agent skill "Security Audit" as security-audit.zip. Unzip it and copy the security-audit folder into ~/.codeium/windsurf/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .windsurf/skills inside that project instead.

More Windsurf skills

Kiro

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-audit” folder into your skills folder:~/.kiro/skills
3 Or paste the install prompt below into Kiro and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Do a full security audit of this repository”

Install prompt: paste this into Kiro

I downloaded the agent skill "Security Audit" as security-audit.zip. Unzip it and copy the security-audit folder into ~/.kiro/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .kiro/skills inside that project instead.

More Kiro skills

Antigravityby Google

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-audit” folder into your skills folder:~/.gemini/antigravity/skills
3 Or paste the install prompt below into Antigravity and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Do a full security audit of this repository”

Install prompt: paste this into Antigravity

I downloaded the agent skill "Security Audit" as security-audit.zip. Unzip it and copy the security-audit folder into ~/.gemini/antigravity/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .agents/skills inside that project instead.

More Antigravity skills

OpenCode

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-audit” folder into your skills folder:~/.config/opencode/skills
3 Or paste the install prompt below into OpenCode and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Do a full security audit of this repository”

Install prompt: paste this into OpenCode

I downloaded the agent skill "Security Audit" as security-audit.zip. Unzip it and copy the security-audit folder into ~/.config/opencode/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

To use the skill in one project only, put it in .opencode/skills inside that project instead. OpenCode also reads ~/.agents/skills, ~/.claude/skills.

More OpenCode skills

Cline

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-audit” folder into your skills folder:~/.agents/skills
3 Or paste the install prompt below into Cline and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Do a full security audit of this repository”

Install prompt: paste this into Cline

To use the skill in one project only, put it in .agents/skills inside that project instead.

More Cline skills

Amp

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-audit” folder into your skills folder:~/.config/agents/skills
3 Or paste the install prompt below into Amp and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Do a full security audit of this repository”

Install prompt: paste this into Amp

I downloaded the agent skill "Security Audit" as security-audit.zip. Unzip it and copy the security-audit folder into ~/.config/agents/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: amp skill add <github-url> --global

To use the skill in one project only, put it in .agents/skills inside that project instead. Amp also reads ~/.agents/skills, ~/.config/amp/skills, ~/.claude/skills.

More Amp skills

Gooseby Block

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-audit” folder into your skills folder:~/.agents/skills
3 Or paste the install prompt below into Goose and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Do a full security audit of this repository”

Install prompt: paste this into Goose

To use the skill in one project only, put it in .agents/skills inside that project instead. Goose also reads ~/.claude/skills.

More Goose skills

OpenClaw

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-audit” folder into your skills folder:~/.openclaw/skills
3 Or paste the install prompt below into OpenClaw and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Do a full security audit of this repository”

Install prompt: paste this into OpenClaw

I downloaded the agent skill "Security Audit" as security-audit.zip. Unzip it and copy the security-audit folder into ~/.openclaw/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: openclaw skills install @owner/<slug>

Built-in installer: openclaw skills install @owner/<slug> --global

Built-in installer: openclaw skills install git:owner/repo@ref

To use the skill in one project only, put it in skills inside that project instead. OpenClaw also reads ~/.agents/skills.

More OpenClaw skills

Hermes Agentby Nous Research

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-audit” folder into your skills folder:~/.hermes/skills
3 Or paste the install prompt below into Hermes Agent and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Do a full security audit of this repository”

Install prompt: paste this into Hermes Agent

I downloaded the agent skill "Security Audit" as security-audit.zip. Unzip it and copy the security-audit folder into ~/.hermes/skills. Before you finish, list every file it contains, show me any scripts and what they do, and stop if anything asks for passwords, API keys or downloads from other websites.

Built-in installer: hermes skills install <owner/repo/skill>

More Hermes Agent skills

VS Codeby Microsoft

1 Download the skill (.zip) with the button at the top of this page, then unzip it.
2 Move the “security-audit” folder into your skills folder:~/.copilot/skills
3 Or paste the install prompt below into VS Code and let it do the copying.
4 Start a new session. Ask for what you want, for example: “Do a full security audit of this repository”

Install prompt: paste this into VS Code

To use the skill in one project only, put it in .github/skills inside that project instead. VS Code also reads ~/.claude/skills, ~/.agents/skills.

More VS Code skills

This skill includes 4 program files. That is normal for skills that build real files, but read them first, and stop if anything asks for passwords or outside downloads.

Questions about Security Audit

Will it attack my live site?

No. It is defensive and source-first, and tells the agent not to probe deployed endpoints or production systems.

Does it write files automatically?

Only in full audit mode, which it runs when you explicitly ask for an audit.

Is the Security Audit skill free?

It is a Premium skill on Best Agent Skills. Premium opens soon, with monthly, yearly and lifetime plans on the pricing page.

Who made the Security Audit skill?

Cloudflare. We did not write it. Best Agent Skills curates skills like this one, explains them in plain words and shows how to add them to your app. It is shared under the MIT licence (Copyright (c) 2025-2026 Cloudflare, Inc.).

Security Audit skill

What Security Audit makes

Example prompts

What’s inside

Which apps it works in

How to add Security Audit to your app

Questions about Security Audit

Skills like Security Audit