Security Audit
Teach your coding agent to audit an app you own like a security reviewer, with verified findings instead of noise.
What we found works best
Use Cloudflare's security-audit-skill as the default. Add Strix only for authorized, sandboxed dynamic testing of your own staging environment.
Cloudflare's skill is audit-only. It requires each finding to be traced through the code and validated by a separate verifier, and leads it can't confirm stay unrated. Strix runs live attacks, so it needs a sandbox and written authorization.
Options we compared
| Option | Cost / account | Can act? | Source |
|---|---|---|---|
| ✅ Cloudflare security-audit-skill A multi-phase audit with separately verified, schema-checked findings | free none | reads code; may run code only inside a sandbox | cloudflare/security-audit-skill MIT · ★ 29k · pushed 2026-09-14 |
| Strix Autonomous pentest agents for staging environments | free (plus model/API costs) LLM API key | ATTACKS live targets: only your own, with authorization | usestrix/strix Apache-2.0 · ★ 68k · pushed 2026-10-14 |
Steps
- Install the audit skill.
- Run recon on a repo you own: architecture, trust boundaries, entry points.
- Run the full audit and review the findings marked
confirmed; treatneeds_validationas an open question. - Fix the confirmed issues with PRs, then re-run.
- Optional: Strix against a sandboxed staging copy, with the owner's written OK.
Traps to avoid
- Treating unvalidated leads as critical
- Running dynamic tests without a sandbox
- Auditing vendor code you aren't allowed to test
Safety
- Never send, post, publish or spend money or credits without the owner's OK.
- Only audit systems you own or are authorized in writing to test.
- No live attacks on production or third-party systems.
- Never paste discovered secrets into chat; report them by file and line, then rotate them.
🔒 Pro plan: guided install
Exact commands for Claude Code, Codex, Grok Bot and Gemini CLI, pinned commits, one step at a time with next_lesson and check_lesson, plus updates.
Stars and last push were checked against the GitHub API. Install commands come from vendor and README docs and have not been executed by us. Marked "unverified" where we couldn't confirm.