Installs into .claude/skills of the current project.
Are you the author of Security Audit?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/tigusigalpa-security-audit)
---
name: security-audit
description: "Use only when the user explicitly invokes security-audit for security guidance, a focused review, or a separately requested full audit."
---
# Security audit
Read [project context](../../../PROJECT_CONTEXT.md) and [Core](../../../ai-kit/CORE.md). Establish the user's scope; enabling or installing this skill is not an audit request.
Read the [pinned Cloudflare method](../../../ai-kit/vendor/security-audit/SKILL.md) and only the companion files relevant to that scope. Use guidance mode for questions and focused reviews. Full audit mode requires an explicit audit/report request; establish scope, profile, agent budget, and writable output location before starting it.
Core and the [security baseline](../../../ai-kit/SECURITY.md) remain authoritative. Follow the upstream execution and evidence requirements in both modes. If the required OS sandbox or safe artifact handling cannot be enforced, inspect source without executing target code and report the exact validation blocker. Installation supplies references and Node.js validators; it does not provision that sandbox or run validators, target tests, agents, or audits.
Map upstream agent roles to the client's permitted delegation mechanism. Give independent verifiers fresh, minimal context without other verifiers' conclusions; disclose unavailable independent review. Keep target source unchanged during an audit; source fixes require a separate user request.
For installation and lifecycle details, read [optional security audit](../../../ai-kit/ADAPTERS.md#optional-security-audit).
