Organize a repository security review around coverage, source evidence, and independent verification. Cloudflare’s Skill separates confirmed findings from unresolved leads and rejected candidates, with explicit report artifacts and execution requirements.
Define the authorized revision and audit boundaries before investigating repository security. Prepare a request that preserves coverage gaps, source traces, and independent validation status, so candidate vulnerabilities remain distinguishable from findings supported by adequate evidence.
Identify the repository, revision, excluded paths, and available isolation.
Copy the request into a new Floatboat conversation and provide the required material.
Download FloatboatPreview and copy the request. It is not sent automatically from this page.
Reference: Security Audit https://github.com/cloudflare/security-audit-skill/blob/main/skills/security-audit/SKILL.md Read the original documentation and check the current environment and dependencies. Propose any new installation or tool connection before proceeding. My task: Review this repository within the scope I authorize. First map architecture and coverage. Keep unresolved leads as needs_validation and show the evidence and gaps in the final reports. Do not execute target-controlled code unless the required isolation is available. Expected deliverable: Coverage and evidence reports with unresolved leads marked needs_validation and remaining gaps made explicit.
Cloudflare’s security-audit Skill coordinates reconnaissance, coverage-led investigation, candidate validation, structured findings, independent record verification, and reporting. It maintains a coverage ledger and distinguishes confirmed, needs_validation, and rejected records. A blocked or unresolved candidate must retain its uncertainty; a report is not a certification that the repository is free of vulnerabilities. The public Skill is a single-repository starting point, distinct from the broader harness described in Cloudflare’s engineering article.
Repository coverage, suspected vulnerabilities, and historical findings need separate evidence checks. Explore how Security Audit maps trust boundaries and challenges candidate issues while keeping unexamined areas and needs_validation findings visible in the audit record.
A repository audit needs an authorized revision, explicit exclusions, and appropriate isolation conditions. Map the architecture, entry points, trust boundaries, and coverage units before dividing investigations. Keep unexamined areas visible in the ledger so assigning work does not create the impression that the entire repository has already been checked.
A suspected vulnerability should face an independent attempt to disprove its mechanism. Give a fresh verifier the candidate, source trace, and observed impact evidence, then compare the verdict with the original claim. Retain needs_validation when evidence is insufficient instead of promoting a plausible concern into a verified finding.
A later audit can use historical ledgers to identify unresolved issues and source changes, but old findings do not establish current coverage. Compare changed code with the earlier evidence and locate gaps that need renewed investigation. Report change impact and remaining uncertainty without inheriting verification that was never repeated.
Completed investigations do not necessarily cover every unit that was assigned. Compare the coverage ledger, verifier outcomes, and remaining questions with the authorized repository scope before preparing the final report. Keep unexplored areas and insufficiently supported issues visible, so parallel activity or a long findings list is not mistaken for a complete security assessment.
A security audit needs a prepared host, an authorized repository scope, and explicit execution boundaries. Follow coverage and investigation into independent validation, then review both issue evidence and unexplored areas rather than treating a findings list as proof of complete coverage.
Confirm compatible tool-using agents, parallel sub-agents, Node.js, output location, and the upstream isolation requirements. Define what the audit is allowed to inspect and execute.
Track coverage, assign bounded investigations, and give each candidate to an independent verifier. Use the supplied ledger and findings validators at the documented checkpoints.
Read the report alongside structured findings and coverage evidence. Require source traces for confirmed issues and preserve the exact missing fact for unresolved leads.
Read another Skill guide and check its original source before using it.
