Run Cloudflare's security-audit skill in Claude Code

Install into Claude Code with the agent flag shown in the Skills CLI help, checked on 2026-10-14:

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit \
  --agent claude-code

Start Claude Code in the repository you want reviewed. The README's examples are "security audit this codebase" and "find security vulnerabilities in ./src". Ask for guidance mode if you only want a question answered. Ask for a full audit only when you mean the six phases.

Before a full audit, set a budget. The skill file says one coverage unit is about one hunter assignment, and a surviving candidate is one or two verifier assignments. It also says the agent must not launch hunters if the remaining budget cannot reserve the critic and verifier calls, and that a strict budget must not be exceeded silently. The README does not name a credit unit or a dollar price. The cost is whatever your coding agent charges for those invocations.