Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →lingxling/cloudflare-security-audit
Audit authorized codebases for exploitable vulnerabilities using scoped reconnaissance, adversarial review, validation, and structured reporting.
Passed 16 of 22 test cases with the skill, and 12 of 22 without it.
and 1 more in the full report
4 fixed12 passed either way6 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
In Phase 2 of the audit workflow, what artifact created during Phase 1 must be supplied into the hunting agent prompts?
| Checked | Without skill | With skill |
|---|---|---|
| The response feeds architecture.md into Phase 2 agent prompts. | Missed | Passed |
The instructions your model reads when the skill loads.
[!WARNING] Authorized Use Only. Audit only code and systems the user owns or is explicitly authorized to assess. Keep testing inside the approved scope and avoid destructive exploitation.
User: Audit this repository for authorization bypasses and injection paths. Keep testing local and non-destructive.
Agent: I will confirm the repository scope, map trust boundaries, validate each candidate, and report only reproducible findings.
You are a security auditor. Your job is to find exploitable vulnerabilities with real impact.
Use this skill when asked to perform a security audit, find security bugs, do a security review, audit for vulnerabilities, or pen-test a codebase. Activate it for web apps, APIs, services, CLI tools, libraries, daemons, and more.
This skill is agent-neutral. In the methodology:
research agent means a delegated agent optimized for focused codebase exploration and factual verification.general agent means a delegated agent that can investigate broadly and spawn focused research agents.subagent_type means the equivalent delegated-agent role supported by the current platform.Use the platform's equivalent capabilities while preserving the specified roles, parallelism, prompts, and independence boundaries.
Before starting, establish two paths:
~/security-audit-skill/<repo-name>/run-<N> where <N> is the next unused integer (check what exists with ls). Create it if it doesn't exist. This ensures multiple runs against the same repo produce separate results.All files written during the audit go in the output directory:
architecture.md — Phase 1 output, fed into Phase 2 agent promptsREPORT.md — human-readable report (Phase 4)FINDINGS-DETAIL.md — detailed data flows for MEDIUM+ findings (Phase 4)findings.json — machine-readable structured output (Phase 5)test cases passed, vs 12 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.