MRPS
← Back to Toolkit

Cloudflare Security Audit

Skill

Instruction set and reference documentation loaded directly into an agent environment.

1. What it does

A coding-agent skill that orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. Produces findings.json validated against a JSON schema plus a coverage ledger, so every claim is traceable and re-runs are additive.

2. Why MRPS selected it

Goes beyond dependency CVEs into source-level vulnerability hunting: isolated hunters, independent verifiers, schema-validated findings, and a coverage ledger that proves what was actually inspected.

3. Tool Kind

Skill: Instruction set and reference documentation loaded directly into an agent environment.

4. Original repository

https://github.com/cloudflare/security-audit-skill

5. Official documentation

https://github.com/cloudflare/security-audit-skill#readme

6. Author and license

Created by Cloudflare under the MIT license.

7. Installation

npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

8. When the AI should use it

Use when the user wants a deep, source-level security audit of a codebase — authentication, authorization, input handling, tenant isolation, supply chain, or agent/LLM surfaces — and not merely a dependency version check.

9. When the AI should not use it

Do not use for a quick dependency CVE scan (that is Trivy), for a single obvious fix, or on systems the user does not own or have written authorization to test.

10. What the AI must not do

  • Before you invoke anything, state what you intend to do, the estimated cost, and the target path. Do not act until the user confirms.
  • Operate on source and local artifacts only. Never exploit, fuzz, or probe a live production or third-party system.
  • Run validate-coverage-ledger.cjs after creating or updating the ledger, and validate-findings.cjs in the output phase and after every replacement.
  • Treat only schema-valid records with a complete source trace as findings. Never promote needs_validation to confirmed to fill a report.
  • Keep prior ledgers and findings: re-runs are additive and must not treat unresolved work as covered.
  • Report rejected candidates in findings.json, not as findings in the human report.

11. MRPS usage instructions

Read COMPREHENSIVE.md

12. Last verified

Verified against live repository on: 2026-11-09

View Complete Agent Constraint Sheet
Tool: Cloudflare Security Audit When to use: Use when the user wants a deep, source-level security audit of a codebase — authentication, authorization, input handling, tenant isolation, supply chain, or agent/LLM surfaces — and not merely a dependency version check. When NOT to use: Do not use for a quick dependency CVE scan (that is Trivy), for a single obvious fix, or on systems the user does not own or have written authorization to test. Invocation: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit, then ask the agent to security audit the codebase. Rules: - Before you invoke anything, state what you intend to do, the estimated cost, and the target path. Do not act until the user confirms. - Operate on source and local artifacts only. Never exploit, fuzz, or probe a live production or third-party system. - Run validate-coverage-ledger.cjs after creating or updating the ledger, and validate-findings.cjs in the output phase and after every replacement. - Treat only schema-valid records with a complete source trace as findings. Never promote needs_validation to confirmed to fill a report. - Keep prior ledgers and findings: re-runs are additive and must not treat unresolved work as covered. - Report rejected candidates in findings.json, not as findings in the human report.