# AI security audit authorization kit Use this kit to commission a contained source-code review with Cloudflare's security audit skill. The skill gives a coding agent procedures for mapping code, investigating possible defects, independently reviewing them and recording findings and coverage. It requires an operating-system-enforced sandbox before executing code under review. It does not provide a live-site penetration test or a compliance certificate. A qualified developer or security specialist must review the results. We read the source and documentation on November 3, 2026; we did not install or run the skill. This template is informational, not legal advice. Have a lawyer licensed where you operate adapt the authorization to your circumstances. ## The flow ```text ┌───────────────────────────────────┐ │ Approved source + dummy test data │ └─────────────────┬─────────────────┘ ▼ Isolated review and checks ▼ Findings + coverage ledger ▼ Developer verifies and fixes Own the systems and rights, or have written permission? No → Get written permission first Yes ▼ Live testing or unclear authority? Yes → Stop and ask a lawyer; scope separately No ▼ Required sandbox and data handling ready? No → Stop execution; record the missing control Yes → Go ahead with logs and human review ``` ## Safe setup checklist - [ ] Name the business owner, technical reviewer and person authorized to stop work. - [ ] Record the exact repository, source revision and any local modifications. A revision is a saved version of the code. - [ ] Confirm ownership or examination rights under the contractor agreement and licenses. Paying for code alone does not settle those rights. - [ ] Complete the authorization below before giving the agent access. - [ ] Review the complete skill and helper source at the public repository. Choose an approved version and record it privately. - [ ] Choose a coding agent that supports tool use and parallel sub-agents, which are separate delegated AI work sessions. Check the actual isolation and delegation controls. - [ ] Approve the AI provider's handling of source and tool output. Remove real credentials and customer records. An isolated test process does not make a cloud AI service offline. - [ ] Ensure Node.js is available for the Skills command tool and the supplied validators. Dependencies are other software the project needs. Do not let target-controlled builds fetch them. - [ ] Pick guidance mode for a focused question or full audit mode for the complete review and report files. - [ ] Choose the quick, standard or deep profile and explicit scope. Quick and scoped reviews must disclose partial coverage. - [ ] Agree an agent-invocation budget and provider spending controls where available. Disable paid extra usage unless approved. Reserve time and money for human review and repeat checks. - [ ] Set a private output destination outside the target repository. The documented default is in the user's home folder, under `security-audit-skill`, then the repository name and the next unused `run-N` folder. An internal destination requires explicit selection and confirmation that version control ignores it. - [ ] Read prior findings and coverage, compare them against current source, and carry forward gaps and changed-source checks. Old conclusions require current verification. The following are the exact installation commands from the [README Installation section](https://github.com/cloudflare/security-audit-skill/blob/main/README.md#installation). They are provided for an approved IT person to review; they were not executed for this kit. Project-level installation: ```bash npx skills add https://github.com/cloudflare/security-audit-skill \ --skill security-audit ``` User-level alternative: ```bash npx skills add https://github.com/cloudflare/security-audit-skill \ --skill security-audit \ --global ``` The README also documents `npx skills --help` for agent-selection options. The Skills command documentation provides `DISABLE_TELEMETRY=1` as an environment setting to disable its optional telemetry, meaning installation-use reporting. Set it before installation if that is your policy. It does not disable AI-provider uploads. Once authorization and containment are ready, the README's example request is: ```text security audit this codebase ``` Attach the approved scope, budget, data rules and stop conditions to the task. The README also recognizes pen-test wording as a trigger; that does not authorize live testing. ## Sandbox checklist A sandbox is an enclosure enforced by the operating system, not an instruction asking the AI to behave. These controls mirror the README and the detailed skill's Universal execution safety and Write isolation sections. - [ ] Target-controlled processes cannot reach external networks. Local client/server checks use only an isolated internal network space. - [ ] Start those processes with an empty environment and an explicit allowlist of safe values. Never pass the host's ambient environment. - [ ] Their home location, temporary directories and caches are confined to assigned temporary storage. - [ ] Target source and toolchain are read-only. If a build must write beside source, use a disposable copy confined to that worker's temporary space. - [ ] Each worker can write only to its own assigned temporary directory. No other worker's files or retained reports are exposed. - [ ] Set explicit low processor, memory, process-count, file-size, disk and wall-clock limits. - [ ] Do not expose host credentials, account sessions, host home storage, communication sockets or shared services. - [ ] Use dummy people, accounts, records and secrets. No production identities or other users' data. - [ ] Use only locally available tools and dependencies. No target-controlled installation, publishing, paid external calls, live control-plane access or live service tests. - [ ] Stop execution at the smallest local observation needed to establish the claimed defect. Do not expand the effect or stress shared systems. - [ ] Before execution, trusted coordinating code records the exact evidence files it may retain and per-file and total size limits, holding protected references to the relevant directories. - [ ] After the process and all its children stop, that code checks every source and destination path component without following links, accepts only bounded regular files with a single link, checks file identity and size for changes, and creates destinations exclusively. No blanket copying of temporary files or archive extraction. - [ ] Never retain links, special files, changing files or files exceeding the limits. If safe evidence collection cannot be enforced, discard the file and record the exact blocker. - [ ] Record the minimum test input, command, containment limits and safe allowlisted values needed for reproduction. Do not capture secrets or the host environment. If any required control is missing, do not execute target code. A source-backed lead may remain `needs_validation` after independent review, with the exact missing capability and a safe next step. Merely having a container is not proof that these controls are configured. ## Security testing authorization letter Copy and adapt this template with counsel. Default authorization is source review and contained local validation only. Any live-system engagement needs a separately reviewed scope and provider permissions; it is outside this skill's documented workflow. ### Parties and authority Authorizing organization: [legal name] System and source owner: [legal name and relationship to the organization] Authorized representative: [name, role, basis of authority to approve this work] Tester or reviewing organization: [legal name] Named human technical lead: [name and contact] Approved coding agent and model provider: [products and approved account/workspace] I confirm that I have authority to authorize the work below on the listed code and isolated systems. This letter grants no authority over third-party systems or rights I do not control. A staff member's ability to sign in does not establish authority to permit security testing. ### Exact scope Included repositories and source revisions: [identifiers and revisions] Included isolated test machines and environments: [unambiguous inventory identifiers] Included components and boundaries: [specific code areas and permitted checks] Excluded components, tenants, accounts and systems: [explicit list] Applicable contractor assignments, licenses and provider permissions: [agreement titles and relevant clauses] Approved start: [date, time and time zone] Approved end: [date, time and time zone] Approved maintenance or review windows: [if applicable] ### Allowed methods Read the identified source. Map trust boundaries and existing controls. Review prior evidence against current source. Perform only minimum bounded checks with dummy data in the approved operating-system-enforced sandbox. Use already available dependencies. Have independent reviewers challenge candidates. Produce private findings, coverage and unresolved-lead records. Specific approved local methods and resource limits: [list] Profile, scope exclusions and maximum agent invocations: [record] Approved paid usage and spending control: [record or no paid extras] ### Forbidden methods No contact with live sites, APIs, cloud control planes (management interfaces) or external services. No real credentials or customer data. No tests against shared infrastructure. No denial-of-service, traffic flooding, persistence, concealment, production changes, artifact publication or network dependency downloads. No bypass of logins, paywalls, CAPTCHA, blocks or other access controls. No access beyond the systems and rights specifically authorized here. Proposed source fixes require separate human review before application. Additional exclusions: [list] ### Data and evidence handling Approved dummy fixtures: [description] Source permitted to reach the AI provider: [scope and contractual basis] Approved recipients and storage controls: [roles, access restrictions and encryption policy] Evidence to retain: [minimum necessary material] Retention deadline and deletion procedure: [date and responsible person] Disclosure procedure: [private contact, review and release approval] No secrets, customer records or unrelated host data may be included in reports. Unexpected sensitive data triggers the stop procedure. The owner decides incident handling with qualified advisers. ### Stop conditions and contacts Stop immediately for a sandbox failure, unexpected external connection, out-of-scope system, personal data or secrets, possible production impact, exceeded budget, access restriction, cease-and-desist notice, unclear authority, or a stop request from an authorized contact. Stop the affected work, preserve only approved minimum evidence, and notify the following contact. Do not investigate further to enlarge the proof. Owner's primary contact: [name, phone, email] Owner's emergency alternate: [name, phone, email] Tester's primary and emergency contacts: [details] Person authorized to revoke permission: [name/role] Only this representative may approve written scope changes: [name/role] Restart requires documented clearance from: [name/role] ### Signatures Authorizing representative: [signature, printed name, title, date/time] Tester accepting scope: [signature, printed name, title, date/time] Technical owner accepting containment and review duties: [signature, printed name, title, date/time] ## Findings triage sheet A finding is a claim supported by evidence. The coverage ledger separately records which parts were examined and which remain blocked, deferred or outside scope. | Field | Record here | |---|---| | Stable finding identifier and source revision | [value] | | Verdict | [confirmed / needs_validation / rejected] | | Independent reviewer | [person reviewing the AI result] | | Claimed or confirmed cause and affected boundary | [specific statement] | | Source trace and evidence | [approved record references] | | Actual bounded result and conditions | [confirmed only] | | Likelihood, demonstrated impact, overall severity | [confirmed only; overall cannot exceed impact] | | Exact missing fact | [needs_validation only] | | Safe local or owner-observed next check | [needs_validation only; no live probe] | | Rejection reason | [rejected only] | | Affected business process | [reviewer's assessment] | | Developer or observation owner and due date | [name/date] | | Proposed fix and review decision | [confirmed only] | | Regression test and independent retest | [result and reviewer] | | Disclosure and closure decision | [authorized owner] | Do not assign severity to `needs_validation`. It is an independently reviewed, source-backed lead with a decisive unresolved fact. A speculative idea or a candidate that never received independent review is not such a record. If budget prevents validation, leave the candidate in the ledger and mark the run incomplete. Keep hardening suggestions, meaning useful extra precautions without a demonstrated defect, separate from vulnerabilities. Before accepting the report: - [ ] Both supplied validators passed for the final records. This verifies structure and consistency, not security correctness. - [ ] Every retained confirmation has current independent verification. Quick mode combines the candidate and final-record checks in one fresh reviewer; other profiles separate them. - [ ] Coverage lists blocked, deferred and excluded work, prior-run use and incomplete candidates. - [ ] The human reviewer can distinguish actual results from assumptions about deployment. - [ ] Confirmed fixes have an owner and retest; unresolved leads have an exact information request. - [ ] Repeated runs address changed code and gaps. No claim that a clean run found every vulnerability. ## Risk table | Risk | Law or contract | Reduce the risk | |---|---|---| | Agent reaches an unauthorized live system | CFAA, 18 U.S.C. § 1030; state computer laws including California § 502 and Texas § 33.02 | Enforce no external network for target code; obtain actual owner authorization and exact scope | | Research is mistaken for blanket legal immunity | DOJ charging policy; private civil and state-law exposure remain | Have counsel review scope; the federal policy does not grant owner permission | | Circumventing a copyright access control | DMCA § 1201(j); conditional security-research exemption in 37 C.F.R. § 201.40(b)(18) | Check all applicable conditions and other laws with counsel before proceeding | | Testing exceeds a hosting agreement or bounty | Provider terms and conditional program authorization | Read and preserve current scope and exclusions; the customer cannot authorize third-party infrastructure | | Private code or records reach an unapproved AI account | Confidentiality, privacy and provider contracts | Approve provider handling, use dummy records, strip secrets, restrict reports and retention | | Untrusted code damages the review machine | Owner's containment and operating obligations | Enforce every sandbox control and stop on any missing capability | | AI result becomes an unsupported customer assurance | Customer contracts and representations | Describe the actual source-review scope, unresolved work and human validation accurately | ## Small business use cards All examples are illustrations. The MIT-licensed skill has no license fee. AI subscription prices below were read November 3, 2026 in US dollars before tax; professional fees and per-audit usage are unknown. Subscriptions do not guarantee audit completion. | Illustration | Reviewer and next step | Cost basis | |---|---|---| | Review your own website or web app before launch | Developer verifies local defects, applies reviewed fixes and retests | Free skill; Claude Pro example $20 monthly; isolation and labor extra | | Review custom WordPress plugin/theme code you own under contract | WordPress developer checks permissions and tests a revised local copy | Free skill; ChatGPT Plus example $20 monthly; contract and review costs unknown | | Accept a contractor's internal tool | Contractor and technical owner resolve evidence before acceptance | Free skill plus eligible existing plan limits; outside review quote required | | Review a small software subscription product before a questionnaire | Security specialist reviews coverage; owner describes only work actually performed | Free skill; Claude Max example $100 monthly; per-run cost unpublished | | Prepare for an outside security firm | Assessor reviews the preliminary ledger and agrees separate professional scope | Free skill plus chosen AI plan and separately quoted firm fee | ## Sources and read dates All read November 3, 2026, UTC. Source references describe documentation, not a tool execution test. - [README and installation](https://github.com/cloudflare/security-audit-skill/blob/main/README.md), 21:34:45: commands, requirements and repeated-run limitation. - [Skill instructions](https://github.com/cloudflare/security-audit-skill/blob/main/skills/security-audit/SKILL.md), 21:35:37: modes, containment, evidence retention, budget and output rules. - [Reconnaissance](https://github.com/cloudflare/security-audit-skill/blob/main/skills/security-audit/RECONNAISSANCE.md), 21:35:34, [hunting](https://github.com/cloudflare/security-audit-skill/blob/main/skills/security-audit/HUNTING.md), 21:35:29, and [validation/reporting](https://github.com/cloudflare/security-audit-skill/blob/main/skills/security-audit/VALIDATION-AND-REPORTING.md), 21:35:40: coverage, verdicts, independent review and incomplete runs. - [MIT license](https://github.com/cloudflare/security-audit-skill/blob/main/LICENSE), 21:35:19: permission, notice and no warranty. - [Skills command documentation](https://skills.sh/docs/cli), 21:35:13: installation options and telemetry switch. - [Claude pricing](https://claude.com/pricing), 21:34:42, and [Codex pricing](https://learn.chatgpt.com/docs/pricing), 21:34:56: subscription examples and variable usage. [ChatGPT pricing](https://chatgpt.com/pricing/), browser-supplied US-view excerpt reviewed 21:44:22: Plus price corroborated. [Claude limits](https://support.claude.com/en/articles/11647753-how-do-usage-and-length-limits-work), 21:35:22: shared and variable allowance. - [CFAA](https://www.law.cornell.edu/uscode/text/18/1030), 21:34:35, and [Van Buren opinion](https://www.supremecourt.gov/opinions/20pdf/19-783_k53l.pdf), 21:34:35: authorization and the Supreme Court's interpretation; majority pages 13 to 14, footnote 8, and page 20. - [DOJ Justice Manual § 9-48.000](https://www.justice.gov/jm/jm-9-48000-computer-fraud), 21:34:36: May 2022 research charging policy, internal guidance and no enforceable rights. - [DMCA § 1201](https://www.law.cornell.edu/uscode/text/17/1201), 21:34:36, and [Copyright Office regulation § 201.40](https://www.copyright.gov/title37/201/37cfr201-40.html), 21:35:19: section (j) and regulatory paragraph (b)(18), conditional research provisions and other-law limits. - [Texas Penal Code chapter 33](https://statutes.capitol.texas.gov/?tab=1&code=PE&chapter=PE.33&artSec=33.02), 21:36:22: section 33.02 and effective owner consent. - [California Penal Code § 502](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=502.&lawCode=PEN), browser-supplied statutory excerpt reviewed 21:41:30: subsections (c)(2), (c)(7) and (e)(1), unauthorized use/access and civil remedy. - [AWS testing policy](https://aws.amazon.com/security/penetration-testing/), 21:34:36, and [Microsoft bounty guidelines](https://www.microsoft.com/en-us/msrc/bounty-guidelines), 21:35:59: provider restrictions and limited authorization. This kit is informational, not legal advice. Mentions of third parties are nominative fair use. No affiliation or endorsement is implied.