---
name: Cloudflare security-audit skill
slug: cloudflare-security-audit-skill
url: https://github.com/cloudflare/security-audit-skill
category: Code scanning
bestFor: "A source-first security audit you run inside a coding agent, with separate agents to hunt and to check each finding."
freeTier: yes
price: "MIT, no separate fee"
checks:
  - source
freeTierNote: "The repository README licenses the skill as MIT and does not list a price. The SKILL.md cost section counts spend as agent invocations: one coverage unit is about one hunter assignment, and a surviving candidate is one or two verifier assignments. A full audit refuses to start if the budget cannot cover reconnaissance plus reserved critic and verifier calls."
verifiedOn: "2026-10-14"
sources:
  - https://github.com/cloudflare/security-audit-skill
  - https://raw.githubusercontent.com/cloudflare/security-audit-skill/main/README.md
  - https://raw.githubusercontent.com/cloudflare/security-audit-skill/main/skills/security-audit/SKILL.md
unknowns:
  - "A dollar price or a named credit balance. The skill file talks about a budget of agent invocations, not a fee."
---

This is a skill for a coding agent, not a hosted scanner. The README describes six phases: reconnaissance, coverage-led hunting, candidate validation, structured findings, an independent check of those records, and a report derived from the verified records. The agent that checks a finding is not the agent that found it.

Install it with the command in the README: `npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit`. The same README says to run `npx skills --help` for agent selection. That help text, read on 2026-10-14, includes `--agent claude-code` in its examples. The skill file itself says it is agent-neutral and does not name Claude Code.