Sander-Felippe

Security Audit Extended — Security skill for Claude Code

Security community

Read-only security audit skill for coding agents.

How to install Security Audit Extended

This entry records only its repository, not the path inside it, so there is no exact command to give. Open Sander-Felippe/security-audit-extended and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Security Audit Extended does

Read-only security audit skill for coding agents. Cloudflare's audit workflow (coverage ledger, verdict contract, validators) extended with methodology from Google's Mantis: threat modelling, history mining, a graded reproduction ladder, severity calibration and exploit chains. Unofficial.

Alternatives in Security

Google Workspace Model Armor — Filter user-generated content for safety 21.6k ★
/web3 Audit — Smart contract security audit using the 10-bug-class methodology 927 ★
Google MCP Security Servers — Security Operations and Threat Intelligence MCP servers 453 ★

README

security-audit-extended

A source-first, read-only security audit skill for coding agents. It merges Cloudflare's audit workflow with methodology from Google's Mantis skill suite.

**This is an unofficial personal merge.** It is not released, maintained, or endorsed by Cloudflare or Google.

Who made what


Cloudflare — the base	The structure and every rule that makes it trustworthy: the six phases, the coverage ledger, the verdict contract, the write isolation, the validators. Eighteen of their twenty files ship here byte-identical to upstream. MIT.
Google (Mantis) — the methodology	The ideas behind five of the six companion files. No Mantis code, prompt text, or file is copied into this repository. Their skills were read, and the methodology was re-expressed in Cloudflare's vocabulary and bounded by Cloudflare's rules. Apache 2.0, included for attribution.
This repository — the merge	Two additive edits to Cloudflare's `SKILL.md` and `VALIDATION-AND-REPORTING.md`, the six companion files, `validate-companion-artifacts.cjs` and its tests, `ORIGIN.md`, and this README. MIT.

[ORIGIN.md](ORIGIN.md) has the file-by-file account, the exact upstream revisions, and the twelve Mantis behaviours that were deliberately dropped with the reason for each.

What it is

Cloudflare's [security-audit-skill](https://github.com/cloudflare/security-audit-skill) provides the structure: six phases, a deterministic coverage ledger, stable fingerprints, a three-verdict contract (`confirmed` / `needs_validation` / `rejected`), write isolation between the coordinating agent and its hunters and verifiers, and two dependency-free validators that make the output machine-checkable.

Google's [Mantis](https://github.com/google/mantis) contributes methodology that Cloudflare's workflow does not have: threat modelling, structural indexing, history mining, a graded reproduction ladder, severity calibration against inflation, deduplica