Cloudflare/Security-Audit-Skill
103 points by donk8r 8 hours ago | 19 comments
  • hyperionultra 7 hours ago |
    Uf, how much tokens?
    • jesse_dot_id 6 hours ago |
      At least 150k on my relatively small FastAPI project, but hit my session limit. Continuing in a few hours.
      • chrisweekly 28 minutes ago |
        Oof. YAGNI. 150k tokens is where you start hitting the "dumb zone" (model attention issues and inconsistent adherence to instructions).
  • drchaim 6 hours ago |
    I threw 1M tokens for nothing in a medium codebase.
    • TZubiri 6 hours ago |
      how much is medium codebase, like 50kloc including docs?
      • throwup238 4 hours ago |
        500kloc plus at least ten million lines of gastown logs.

        For a todo cli. That doesn’t work.

        • this_user 3 hours ago |
          Welcome to agentic coding in 2026.
      • drchaim 3 hours ago |
        in this case medium is relative to the projects I've worked. Bad expression anyway.
  • prodigycorp 5 hours ago |
    Hi Cloudflare people, if you are reading this. Please clean up your Cloudflare. Skills. There are way too many skills for the platform. You should consolidate all of your skills into a single skill and route everything thru that skill. The way it is right now pollutes our context window.

    https://github.com/cloudflare/skills/tree/main/skills

    • m00dy 4 hours ago |
      I'm sure they read here.
    • mooktakim 2 hours ago |
      I really don't understand why they didn't create an "app store" style skills library where it could be approved and scanned for security issues
  • 9el 3 hours ago |
    Any clues why "an OS-enforced sandbox" is in requirements?
    • nicce 2 hours ago |
      Probably to save their skin if agent starts to do some unexpected things and bringing havoc. But I doubt that OpenAI models with normal subscription, for example, wont even work with this skill.
  • gbrindisi 3 hours ago |
    Shameless plug: in case someone finds this requiring too many tokens, we shared the recipe on how we built our own in house audit skill so that it can easily be replicated and tuned to different environments https://www.synthesia.io/post/automating-code-security-revie...
    • gyanchawdhary 2 hours ago |
      This is awesome. Thanks for sharing
  • wslh 7 minutes ago |
    Tip for security professionals using LLMs: audit skills that explicitly frame the task as security research sometimes trigger refusals from the top OpenAI and Anthropic models because they guard against misuse. What works for me: separate skills for bug classes (and bugs in general) without the security framing, plus another skill that combines their findings to spot security bugs.