README.md

# Cloudflare Security

Multi-skill security audit guidance for Cloudflare accounts and applications. The package is skills-only; it does not bundle an MCP server or Cloudflare credentials. Where the user has connected an authorized Cloudflare integration, use minimal read-only operations to inspect relevant configuration. Otherwise, review code and settings the user supplies.

For explicit full codebase audits, the bundled Cloudflare `security-audit` skill provides a six-phase, coverage-led workflow with independent finding verification and machine-readable reports. It is guidance-only by default; full report generation is reserved for explicit full-audit or report-artifact requests. It requires a capable coding agent, Node.js for validators, and an OS-enforced sandbox before running target-controlled code.

Audits do not change account configuration. Require explicit approval for each production mutation. Never claim complete security; show audit scope, evidence, unavailable checks, and residual risk.

## Third-party source

The `skills/security-audit/` directory is adapted from Cloudflare's MIT-licensed [security-audit-skill](https://github.com/cloudflare/security-audit-skill), pinned to commit `c1c8a8c1471069fb0e188eeaff69b8e8db6564a`. The license and copyright notice are included at `third_party/cloudflare-security-audit-skill/LICENSE`.

Customer support: https://thedoersfirm.com/support  
Privacy: https://thedoersfirm.com/privacy  
Terms: https://thedoersfirm.com/terms