Cloudflare Security Audit Skill: evidence-led reviews for coding agents
Installing Security Audit Skill: agent files, Node.js and isolation
Deploy the skill as a reviewed agent capability, with audit artifacts outside the target.
What you will learn
- Review the installation source
- Provide the runtime requirements
- Separate output and target
Before you start
- Source review and JSON knowledge
- Explicit target authorization and isolation planning
A proposed learning project keeps source revisions, coverage gaps and verdicts visible.
Key takeaways
- Installation does not verify containment.
- Repository URLs may be mutable.
- Audit artifacts need a deliberate location.
Review the installation source
The README documents installation through the Skills CLI with the security-audit selector. Inspect the repository and destination before installation, and record the actual installed revision for later comparisons.
The documented repository URL tracks mutable source unless your installation procedure pins it. The command below is upstream usage, not a claim that it installs exactly the commit analyzed here.
Provide the runtime requirements
The workflow needs a compatible coding agent and Node.js for zero-dependency validators. Zero dependency describes these local scripts; model access, the agent host and containment remain separate infrastructure.
Do not infer an OS sandbox from a successful skill installation. Check networking, environment, process resources and writable paths before any target-controlled command becomes eligible to run.
Separate output and target
The documented default places run artifacts outside the target repository. Writing inside the target requires an explicitly selected ignored directory, which avoids mixing audit records into the reviewed source.
Preserve prior runs and the installed skill version when upgrading. No installation was executed for this series, and no production target or external service was scanned.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Review files and record the installed revision.
- 2
Check agent, Node.js and sandbox separately.
- 3
Choose an output location outside the target.
Copy-ready example
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-auditFrequently asked questions
Is this a hosted scanning service?
The repository provides an agent skill and local validators.
Does the command pin the analyzed commit?
No. Record and verify the installed revision through your installation procedure.
Sources
- Security Audit Skill / README.mdSource checked 2026-09-23