Security Audit
A six-phase repository audit Skill with coverage ledgers, independent finding verification, and structured reports.
- Coding
- Development Workflows
- Security Review
- Security
- Code Review
Cloudflare
Explore Cloudflare developer tools and Agent Skills for building Workers applications, stateful agents, and coordinated services. Compare development guidance with security research workflows, and understand how the software, runtime capabilities, and task instructions fit into an application delivery process.
About Cloudflare
Cloudflare develops an Internet platform spanning application delivery, security, networking, and developer services. Its public repositories include runtime software, deployment tooling, protocol implementations, and application frameworks. Its developer tools and Agent resources connect coding tasks to concrete platform capabilities.
Workers SDK supports application development and local testing, while Agents SDK supplies building blocks for stateful AI applications. Companion Skills guide the use of those tools and related services such as Durable Objects. The instructions organize implementation choices; the SDKs, CLI, and hosted platform provide the software and execution environment.
Cloudflare also publishes security-audit, a separate instruction collection for source-based security investigation. It structures evidence gathering and independent checking of candidate findings, rather than certifying that a codebase is safe. The development Skills and security workflow serve different tasks and should be selected according to the work being performed.
Selected Cloudflare Skills
Cloudflare's selected Skills cover stateful agents, Durable Objects, Wrangler projects, and repository security review. Compare these task boundaries with your application stage, then inspect the original workflow for the inputs and service conditions needed by each guide.
More Teams and Creators
Explore projects and Agent Skills from more teams and creators. Compare their technical focus, representative work, and intended tasks to discover resources relevant to your development, collaboration, or research workflow.
Cloudflare FAQ
Is security-audit part of the general Cloudflare Skills repository?
It is published in its own cloudflare/security-audit-skill repository. The broader cloudflare/skills collection focuses on building with Cloudflare products; the security workflow is a separate resource for source-based reviews.
Does a security-audit report establish that an application is safe?
No. Its records distinguish confirmed findings, unresolved candidates, and rejected leads within the work performed. Coverage records and validation evidence help readers assess that work, but do not establish the absence of every vulnerability.
What changes between guidance mode and full audit mode?
Guidance mode addresses a security question or focused investigation. Full audit mode uses the multi-phase workflow and produces the defined report artifacts when a complete audit or those artifacts are explicitly requested.
How is the Agents SDK Skill different from the SDK itself?
The Skill helps an agent find documentation and implement or review an application. The agents software package supplies runtime classes and APIs. The instruction file does not replace the SDK dependency or the platform configuration.
When is the Durable Objects Skill useful?
Use it for applications needing persistent state and coordination, such as rooms, sessions, scheduling, or WebSocket services. It covers implementation and review concerns including RPC methods, alarms, bindings, and storage design.
Should every new Cloudflare project use the Wrangler Skill?
The current instruction targets existing Wrangler configuration or an explicit Wrangler request. It routes new or differently configured projects toward the appropriate Cloudflare CLI guidance, so first inspect the project configuration.
Choose Between a Code Audit and an Agent Implementation
Compare the security-audit and Agents SDK instructions against the task at hand. For a review, prepare scope and evidence; for an implementation, check the runtime and state requirements.