security-audit
Audit Codebases for Security Vulnerabilities
Security reviews often miss trust-boundary failures or produce weak evidence. This skill structures reconnaissance, isolated validation, independent verification, and actionable reporting.
Остановитесь и запросите подтверждение перед установкой.
Проверьте план и получите явное согласие пользователя перед изменением файлов.
Установить с помощью моего Агента
Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.
Review the Skillstore skill "security-audit" from https://skillstore.io/skills/cloudflare-security-audit.md and its manifest at https://skillstore.io/api/skills/cloudflare-security-audit/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.
Ресурсы для AI-агентов
Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.
Протестировать
Использование «security-audit». Review the account export endpoint for cross-tenant access.
Ожидаемый результат:
The review traces tenant selection, authorization, export assembly, and download delivery. It reports confirmed boundary failures or exact validation blockers.
Использование «security-audit». Run a standard audit of this service and prepare reports.
Ожидаемый результат:
- Architecture and trust-boundary summary
- Coverage ledger with reviewed and deferred units
- Verified findings with evidence and focused fixes
- Separate needs-validation items for external assumptions
Использование «security-audit». Check whether this parser crash is a security vulnerability.
Ожидаемый результат:
The assessment distinguishes self-impact from a crossed trust boundary, records the observable result, and calibrates severity to demonstrated impact.
Аудит безопасности
БезопасноAll 400 cataloged static matches are false positives caused by defensive documentation, readable validator syntax, or bounded negative tests. The reviewed files show no malicious intent, prompt injection, credential access, obfuscation, or unsafe command construction. Static review was capped at 400/560 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
Факторы риска
⚙️ Внешние команды (50)
⚡ Содержит скрипты (4)
📁 Доступ к файловой системе (50)
Поделиться и цитировать этот отчет
Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.
Копировать ссылку на отчёт
https://skillstore.io/skills/cloudflare-security-audit/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportЗначок Markdown
[](https://skillstore.io/skills/cloudflare-security-audit?utm_source=security_passport_badge)Значок HTML
<a href="https://skillstore.io/skills/cloudflare-security-audit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cloudflare-security-audit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Встраиваемая карточка
<iframe src="https://skillstore.io/embed/skills/cloudflare-security-audit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Академические ссылки (APA · BibTeX · CFF)
Цитата APA
cloudflare. (2026). security-audit security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cloudflare-security-audit/audits/1Цитата BibTeX
@techreport{cloudflare-cloudflare-security-audit-2026,
author = {cloudflare},
title = {security-audit security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/cloudflare-security-audit/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-audit security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "cloudflare"
date-released: "2026-09-17"
url: "https://skillstore.io/skills/cloudflare-security-audit/audits/1"
identifiers:
- type: other
value: "skillstore:cloudflare-security-audit:audit:1"
description: "Skillstore immutable audit report identifier"
Сравнить варианты
5 устанавливаемых вариантовНавык каждого автора остаётся отдельным устанавливаемым вариантом. Рекомендуемый вариант ранжируется по данным Skillstore.
Почему этот вариант первый
89jobrien-security-audit
2026-10-18
applelamps-security-audit
2026-10-24
cloudflare-security-audit
2026-09-22
consiliency-security-audit
2026-09-09
sickn33-security-audit
2026-09-09
Оценка Skillstore
Почему такая оценка Достоверность доказательств: СреднийЧто вы можете построить
Review an application release
Assess trust boundaries, authorization, data isolation, and deployment-sensitive risks before release.
Investigate a suspected vulnerability
Trace a specific claim through source and design a minimal local validation plan.
Standardize security assessments
Apply consistent coverage, evidence, verification, severity, and reporting requirements across repositories.
Попробуйте эти промпты
Review [file or component] for [security concern]. Identify the trust boundary, source evidence, impact, and smallest effective fix.
Audit [subsystem] for authorization, input validation, and data-isolation failures. Keep execution local and report unresolved deployment assumptions.
Perform a standard security audit of [repository]. Use the full workflow, create required report artifacts, and validate candidates in an enforced sandbox.
Perform a deep audit of [repository] within [scope]. Prioritize [critical assets], use independent verification, and document coverage gaps and validation blockers.
Лучшие практики
- Define scope, authorization, profile, sandbox controls, and budget before beginning a full audit.
- Use dummy data and stop validation at the minimum local effect needed to prove the security outcome.
- Require source evidence, an affected principal, a crossed boundary, and independent verification for confirmed findings.
Избегать
- Do not execute target-controlled code without network, environment, filesystem, and resource isolation.
- Do not label missing best practices or unverified deployment assumptions as confirmed vulnerabilities.
- Do not test production systems, shared infrastructure, live identities, or external services.
Часто задаваемые вопросы
When does the skill run the complete audit workflow?
Can it review one suspected issue?
Does it execute repository code?
How does it reduce false positives?
What reports can it produce?
Can it assess deployed cloud controls?
Сведения для разработчиков
Автор
cloudflareЛицензия
MIT
Ревизия Skillstore
r1
Примечание о версии
Автор не указал версию.
Ссылка
07adf1dffd3a2975d28aef39537f7db8cde3546f
Актуальность поддержки
18.09.2026
Использование
0 загрузок · 0 просмотров