Cloudflare Security Audit

This is the skill that started Cloudflare's own system for finding security holes. It runs a full audit in six phases: map how the app works and where outside data comes in, send separate agents hunting for weaknesses, then hand each suspected problem to a fresh agent whose job is to prove it wrong.

What survives is sorted into confirmed, needs checking and rejected, and written up as a report with the evidence for each item. Running it again on the same project builds on the last run, and Cloudflare found one run catches roughly half of what repeated runs find.

It's thorough and expensive. A full audit uses a lot of tokens, and to safely run your code during testing it expects a locked-down sandbox. Without one, it leaves those items as "needs checking" instead of guessing.

You need Node.js. In a terminal run npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit, adding --global to use it in every project. Then open your project in Claude Code and ask for a security audit.

Founders and developers about to launch something that holds customer data or takes payments.

• A security check before launch
• Auditing code a contractor wrote
• Apps handling customer data
• Repeat audits after big changes