# Security Audit Skill

> MIT coding-agent skill for multi-phase security audits

**Category:** AI Agents  
**Pricing:** open-source  
**URL:** https://github.com/cloudflare/security-audit-skill  
**GitHub:** https://github.com/cloudflare/security-audit-skill  
**Added:** 2026-09-17

---

## The Hook

Cloudflare’s security-audit-skill turns a coding agent into a multi-phase security auditor with independently verified, machine-readable findings.

## What's Good

MIT (cloudflare/security-audit-skill). Skill package for agent hosts: phased audit flow, verified findings, machine-readable output shaped for CI and review loops. First-party Cloudflare org surface (~7.7k★). Install into the agent’s skill path; no separate SaaS account for the skill itself.

## The Catch

Skill only — not a standalone SaaS scanner. Distinct from mcp-security-audit (awesome-copilot skill for .mcp.json / MCP config audits) and from OWASP ASI checklist skills: this is Cloudflare’s multi-phase code/security audit skill for a coding-agent host. You still need the agent runtime and any scanners the skill shells out to.

## Verdict

MIT agent security-audit skill. Phased findings vs mcp-security-audit; not a SaaS scanner.