Security Audit
A six-phase repository audit Skill with coverage ledgers, independent finding verification, and structured reports.
Cloudflare
- Coding
- Development Workflows
- Security Review
- Security
- Code Review
Security Review Skills and Agent Configuration Checks
Use Security Audit for scoped code review, and ECC for install previews, host configuration, and hook-trust checks. Define the revision and evidence required for each task.
Keep Audit Findings Separate from Security Guarantees
Use Security Audit for a scoped code-security review, with a pinned revision and evidence for each finding. ECC serves a different purpose here: inspect its install preview, host configuration, and hook trust before enabling agent workflows. It does not supply a substitute vulnerability audit. Keep code findings separate from configuration decisions, and record what was checked, under which permissions, and what remains unverified.
Security Review Skills
Security Review Projects
ECC
Preview coding-agent setup, inspect host-specific hooks, and check installed configuration.
Affaan Mustafa
- Development Workflows
- Security Review
- Agent Workflows
- Security
Skills supply instructions; projects supply software or supporting resources. Check each source for setup, runtime, access, and license requirements.
Choose by the Job
Review a specific diff
Pin the revision and identify changed trust boundaries before expanding the review scope.
Review configuration before enabling hooks
Use ECC’s install preview and diagnostics to inspect host configuration and hook trust before activating the workflow.
Verify a finding
Record preconditions, affected paths, and a bounded reproduction before assigning severity.
Explore Related Task Categories
Find instructions and software for the next stage of your work, from code changes and interface design to office tasks and media production.
Frequently Asked Questions
Is a listed resource a security certification?
No. The directory describes resources; it does not certify their code or the systems reviewed with them.
How is security review different from code review?
It focuses on abuse paths, trust boundaries, and unauthorized effects rather than only maintainability or intended behavior.
Why is ECC included beside an audit Skill?
ECC is included for install previews, host configuration, and hook-trust checks before enabling agent workflows. Use Security Audit for the separate code-audit task; ECC’s configuration workflow is not vulnerability analysis.
What evidence should accompany a vulnerability claim?
Provide the affected revision, reachable path, necessary permissions, and observed impact. Label untested hypotheses explicitly.
Can the agent probe a third-party service?
Only within an expressly authorized target and testing scope. Possessing a guide does not grant permission to probe systems.
When is a security fix ready for review?
Show that the original path is blocked, intended behavior still works, and regression checks cover the relevant boundary.
Document the Security Finding
Specify the target revision, permitted scope, and evidence needed to distinguish a confirmed finding from a hypothesis.