技能 security-audit
📦
security-audit
內容修訂 r1 安全 ⚙️ 外部命令⚡ 包含腳本📁 檔案系統存取
Audit Codebases for Security Vulnerabilities
Security reviews often miss trust-boundary failures or produce weak evidence. This skill structures reconnaissance, isolated validation, independent verification, and actionable reporting.
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "security-audit" from https://skillstore.io/skills/cloudflare-security-audit.md and its manifest at https://skillstore.io/api/skills/cloudflare-security-audit/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「security-audit」。 Review the account export endpoint for cross-tenant access.
預期結果:
The review traces tenant selection, authorization, export assembly, and download delivery. It reports confirmed boundary failures or exact validation blockers.
正在使用「security-audit」。 Run a standard audit of this service and prepare reports.
預期結果:
- Architecture and trust-boundary summary
- Coverage ledger with reviewed and deferred units
- Verified findings with evidence and focused fixes
- Separate needs-validation items for external assumptions
正在使用「security-audit」。 Check whether this parser crash is a security vulnerability.
預期結果:
The assessment distinguishes self-impact from a crossed trust boundary, records the observable result, and calibrates severity to demonstrated impact.
安全審計
安全v1 • 2026/9/17 開啟版本化報告
All 400 cataloged static matches are false positives caused by defensive documentation, readable validator syntax, or bounded negative tests. The reviewed files show no malicious intent, prompt injection, credential access, obfuscation, or unsafe command construction. Static review was capped at 400/560 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
20
已掃描檔案
5,296
分析行數
0
複核項目
0
已忽略的誤報
風險因素
⚙️ 外部命令 (50)
AI-AND-LLM.md:17 ATTACK-CLASSES.md:121 CLIENT-SIDE.md:16 CLOUD-AND-DEPLOYMENT.md:16 DATA-ISOLATION-AND-LIFECYCLE.md:16 DESKTOP-MOBILE-AND-LOCAL-IPC.md:16 HUNTING.md:55-69 HUNTING.md:69-97 HUNTING.md:112 HUNTING.md:117-120 HUNTING.md:120-134 HUNTING.md:134-136 HUNTING.md:154-157 MEMORY-SAFETY-AND-BINARY.md:16 PROTOCOLS-RPC-AND-MESSAGING.md:16 RESOURCE-EXHAUSTION-AND-AVAILABILITY.md:16 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:36 SKILL.md:37 SKILL.md:40 SKILL.md:48 SKILL.md:51 SKILL.md:58 SKILL.md:59 SKILL.md:60 SKILL.md:61 SKILL.md:62 SKILL.md:63 SKILL.md:64 SKILL.md:66 SKILL.md:68 SKILL.md:70 SKILL.md:73 SKILL.md:75 SKILL.md:80 SKILL.md:86 SKILL.md:96 SKILL.md:99 SKILL.md:100 SKILL.md:101 SKILL.md:102 SKILL.md:103 SKILL.md:109 SKILL.md:111 SKILL.md:112 SKILL.md:113 SKILL.md:115 SKILL.md:117
📁 檔案系統存取 (50)
ATTACK-CLASSES.md:117 validate-coverage-ledger.cjs:745 validate-coverage-ledger.cjs:379 validate-coverage-ledger.test.cjs:65 validate-coverage-ledger.test.cjs:71 validate-coverage-ledger.test.cjs:604 validate-coverage-ledger.test.cjs:643 validate-coverage-ledger.test.cjs:652 validate-coverage-ledger.test.cjs:653 validate-coverage-ledger.test.cjs:664 validate-coverage-ledger.test.cjs:65 validate-coverage-ledger.test.cjs:652 validate-coverage-ledger.test.cjs:292 validate-coverage-ledger.test.cjs:322 validate-coverage-ledger.test.cjs:496 validate-coverage-ledger.test.cjs:497 validate-coverage-ledger.test.cjs:526 validate-coverage-ledger.test.cjs:62 validate-coverage-ledger.test.cjs:593 validate-coverage-ledger.test.cjs:627 validate-coverage-ledger.test.cjs:648 validate-coverage-ledger.test.cjs:62 validate-coverage-ledger.test.cjs:593 validate-coverage-ledger.test.cjs:627 validate-coverage-ledger.test.cjs:648 validate-coverage-ledger.test.cjs:653 validate-findings.cjs:598 validate-findings.cjs:633 validate-findings.cjs:598 validate-findings.cjs:87 validate-findings.cjs:475 validate-findings.cjs:697 validate-findings.test.cjs:106 validate-findings.test.cjs:112 validate-findings.test.cjs:441 validate-findings.test.cjs:482 validate-findings.test.cjs:491 validate-findings.test.cjs:492 validate-findings.test.cjs:503 validate-findings.test.cjs:106 validate-findings.test.cjs:491 validate-findings.test.cjs:321 validate-findings.test.cjs:322 validate-findings.test.cjs:607 validate-findings.test.cjs:608 validate-findings.test.cjs:103 validate-findings.test.cjs:430 validate-findings.test.cjs:466 validate-findings.test.cjs:487 validate-findings.test.cjs:103
最近一次完成的靜態與語意稽核未偵測到已確認的安全發現。這並不能證明該 Skill 沒有副作用。
審計單位: codex
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/cloudflare-security-audit/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/cloudflare-security-audit?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/cloudflare-security-audit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cloudflare-security-audit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/cloudflare-security-audit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
cloudflare. (2026). security-audit security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cloudflare-security-audit/audits/1BibTeX 引用
@techreport{cloudflare-cloudflare-security-audit-2026,
author = {cloudflare},
title = {security-audit security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/cloudflare-security-audit/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-audit security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "cloudflare"
date-released: "2026-09-17"
url: "https://skillstore.io/skills/cloudflare-security-audit/audits/1"
identifiers:
- type: other
value: "skillstore:cloudflare-security-audit:audit:1"
description: "Skillstore immutable audit report identifier"
比較變體
5 個可安裝變體每位作者的技能都保留為獨立的可安裝項目。推薦變體依 Skillstore 證據排序。
為何此變體排名第一
Skillstore 評分最高
作者 / 來源 Skillstore 評分 證據置信度 Skillstore 使用量 已更新
Skillstore 評分
評分依據 證據置信度: 中 55
架構
85
可維護性
87
內容
65
社群
91
規範符合度
你可以打造什麼
Review an application release
Assess trust boundaries, authorization, data isolation, and deployment-sensitive risks before release.
Investigate a suspected vulnerability
Trace a specific claim through source and design a minimal local validation plan.
Standardize security assessments
Apply consistent coverage, evidence, verification, severity, and reporting requirements across repositories.
試試這些提示
Review one security concern
Review [file or component] for [security concern]. Identify the trust boundary, source evidence, impact, and smallest effective fix.
Audit a subsystem
Audit [subsystem] for authorization, input validation, and data-isolation failures. Keep execution local and report unresolved deployment assumptions.
Run a standard codebase audit
Perform a standard security audit of [repository]. Use the full workflow, create required report artifacts, and validate candidates in an enforced sandbox.
Run a deep high-stakes assessment
Perform a deep audit of [repository] within [scope]. Prioritize [critical assets], use independent verification, and document coverage gaps and validation blockers.
最佳實務
- Define scope, authorization, profile, sandbox controls, and budget before beginning a full audit.
- Use dummy data and stop validation at the minimum local effect needed to prove the security outcome.
- Require source evidence, an affected principal, a crossed boundary, and independent verification for confirmed findings.
避免
- Do not execute target-controlled code without network, environment, filesystem, and resource isolation.
- Do not label missing best practices or unverified deployment assumptions as confirmed vulnerabilities.
- Do not test production systems, shared infrastructure, live identities, or external services.
常見問題
When does the skill run the complete audit workflow?
It runs the complete workflow only when the user explicitly requests a full audit, penetration test, or report artifacts.
Can it review one suspected issue?
Yes. Guidance mode supports focused source review, triage, methodology, and investigation without creating full audit artifacts.
Does it execute repository code?
Only when required controls are available in an OS-enforced sandbox. Otherwise, it records a validation blocker and proposes a safe plan.
How does it reduce false positives?
It requires a concrete trust boundary, observable security outcome, bounded validation, and independent verification before confirming a finding.
What reports can it produce?
It can produce architecture, coverage, findings, detailed evidence, needs-validation, and run-metadata artifacts for an authorized full audit.
Can it assess deployed cloud controls?
It can review source-visible configuration. Provider settings or runtime controls outside the repository remain needs-validation items.
開發者詳細資訊
作者
cloudflare授權
MIT
Skillstore 修訂
r1
版本提示
作者未聲明版本。
引用
07adf1dffd3a2975d28aef39537f7db8cde3546f
維護新鮮度
2026/9/18
使用量
0 次下載 · 0 次瀏覽