[JacobStephens2]

Summary

Installs Cloudflare's security-audit skill with npx skills add, symlinked for Claude Code and Grok like the other skills.

 .agents/skills/
+└── security-audit/          # SKILL.md, 13 hunting/phase guides, report schema, 2 validators
 .claude/skills/
+└── security-audit -> ../../.agents/skills/security-audit
 .grok/skills/
+└── security-audit -> ../../.agents/skills/security-audit
 skills-lock.json
+  "security-audit": { "source": "cloudflare/security-audit-skill", ... }

By default it only gives guidance. It runs the full six-phase audit and writes report files only when someone asks for a full audit or pen test.

Evidence

• Before: security-audit isn't in the agent's skill list.
  After: it shows up as an available skill. The bundled validator tests pass: validate-findings.test.cjs 34/34 and validate-coverage-ledger.test.cjs 31/31.
• The validators only use Node's built-in modules (fs, path, util). They make no network calls and start no other processes. skills add reported Gen: Safe, Socket: 0 alerts, Snyk: Med Risk.

Merge Danger

Door: two-way

To undo it, delete the skill directory and its symlinks, then remove its skills-lock.json entry.

Blast Radius: agent-only

No Rust code or build changes. The only effect is that agents in this repo can load the skill.

🤖 Generated with Claude Code