Cloudflare Security Audit Skill: evidence-led reviews for coding agents
Try Security Audit Skill on an authorized synthetic repository
Plan a small trial with explicit stopping conditions before allowing target-controlled execution.
What you will learn
- Choose a bounded exercise
- Check the execution environment
- Inspect the resulting records
Before you start
- Source review and JSON knowledge
- Explicit target authorization and isolation planning
A proposed learning project keeps source revisions, coverage gaps and verdicts visible.
Key takeaways
- Authorization precedes testing.
- Containment must be enforced outside the prompt.
- A blocked lead stays unresolved.
Choose a bounded exercise
Use a repository you own or have explicit permission to assess, ideally a disposable teaching fixture. Pin its revision and state which directories, inputs and local checks are allowed.
Start by mapping a small input boundary and recording its coverage unit. Avoid treating a broad instruction to explore code as permission to contact production services or use credentials.
Check the execution environment
The README requires OS-enforced isolation for target-controlled builds, tests and processes: networking disabled, sanitized allowlisted environment, resource limits and writes restricted to assigned scratch paths.
A prompt that tells an agent to be careful cannot establish these controls. If the required containment is unavailable, preserve the exact blocked fact as needs_validation instead of executing the target.
Inspect the resulting records
Check that each conclusion refers to the pinned source and distinguishes observations from hypotheses. Validate ledger changes and findings records using the supplied validators after reviewing their provenance.
This is a trial plan, not an executed example. The text below records scope only; it is neither a valid findings.json document nor a request to run a security audit from this article.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Pin an authorized synthetic target.
- 2
Verify isolation before target execution.
- 3
Keep unresolved facts visible in the records.
Copy-ready example
trial_plan:
target: owned-synthetic-fixture
source_revision: record-before-start
network: disabled
writes: assigned-scratch-only
runtime_validation: not-executedFrequently asked questions
Can I use a public repository without contacting its service?
Source review still needs clear scope; permission for active testing must be established separately.
What if the sandbox is missing?
Do not run target-controlled code; retain the unresolved validation requirement.
Sources
- Security Audit Skill / README.mdSource checked 2026-09-23