ForkFree

Security and privacy

security-audit-skill

by cloudflare

A skill for coding agents that makes them carry out a structured security audit of a codebase. It runs separate agents through mapping, hunting, checking and reporting, and produces machine-readable findings and written reports.

Worth a lookEstablished, with a few things to check (listed below).

View on GitHub

Stars
49k
Licence
MIT
Runs on
Your computer
Setup
Moderate
Language
JavaScript
Age
130 days

What you can do with it

  • Ask your coding agent to run a full security audit of a repository
  • Get findings sorted into confirmed, needs validation and rejected, with a JSON file and written reports
  • Re-run audits over time so each run builds on earlier coverage and finds more issues

Make money with it

A freelance developer could offer paid pre-release security reviews of client codebases, using the reports as a starting point for their own checks.

An idea, not financial advice. Check the licence before charging for anything built on it.

Ways a business could use it

  • Review your own product's code for vulnerabilities before launch, instead of paying for an initial outside audit
  • Produce structured security reports for client projects as part of a freelance development or review service

Can you use it commercially?

Free to use, change and sell, including in paid products. Keep the copyright notice.

Not legal advice. Read the project's licence file before building a product on it.

Getting it running

Install it with the Skills CLI using npx skills add, then ask a compatible coding agent to run a security audit; Node.js is needed for the validators.

Follow the official instructions in the project README.

Things to check

  • Needs a coding agent and model that supports parallel sub-agents, which will likely cost money in model usage
  • Running target code safely needs an OS-enforced sandbox, otherwise leads stay unverified
  • Findings are AI-generated and need human review
  • Single runs miss many issues, so repeated runs are advised

Who's talking about it

Checked 27 Oct 2026. Summary drafted by AI from the project's README.

More in Security and privacy

RemoveMacAI omlahore
New and promising

RemoveMacAI is a tool to debloat macOS by turning off Apple Intelligence, analytics, ads, and pop-ups, allowing users to regain disk space and privacy.

5.4k stars +60 a day MIT
pentagi vxcontrol
Ready to use

PentAGI is an open-source, self-hosted system for autonomous penetration testing that uses AI agents to perform complex tasks in a secure, isolated environment.

32.5k stars +45 a day MIT
sherlock sherlock-project
Worth a look

Sherlock is a command-line tool that checks whether a given username exists on many social networks and websites. It is used to find a person's or brand's online accounts for research and investigation.

95k stars +32 a day MIT