# security-audit-skill (cloudflare/security-audit-skill) — test plan

Written 2026-10-28 08:53 UTC+8, BEFORE installing the skill or running any agent. Skill repo commit c1c8a8c (2026-09-14).
(Bundled validator test suites were already glanced at once while reading the repo: `node --test` 65/65 at 08:52; rerun below as C2 evidence.)

## Core vs non-core
Core: C2, C3. Non-core: C1.
Verdict = worst core claim; any core V0 caps overall at V1. Score = mean of tested claims (V2=10, V1=5, F=0).

C1 (non-core) Install: `npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit` (non-interactive, agent opencode).
  V2: installs the skill files unchanged (diff vs repo = 0). V1: needs workaround. F: fails.
C2 (core) "Zero-dependency validator for findings.json" / coverage ledger: bundled tests pass with plain Node; validator accepts a
  schema-valid document and rejects our 4 crafted bad ones (missing root_cause; needs_validation carrying severity; unsorted
  fingerprints; trace line 0). V2: tests pass + 1/1 accept + 4/4 reject with a clear message. V1: 1-2 misses. F: worse.
C3 (core) "turns your agent into a security auditor": full audit (profile quick) by a coding agent (OpenCode, free OpenRouter model)
  on our planted target (02-target-server.py, git 7f244ec). Ground truth (02-ground-truth.json):
   P1 SQL injection, search_notes, server.py:22 (string-formatted LIKE query)
   P2 Path traversal / cross-user file read, read_attachment, server.py:39-40
   P3 Missing ownership check (IDOR) on delete, delete_note server.py:32-35 via POST /delete line 82
   Decoys (must NOT be confirmed): get_note (parameterised + owner check), read_avatar (abspath + prefix check).
  V2: 3/3 planted reported as confirmed or needs_validation at the right function, 0 decoys confirmed, findings.json passes
  validate-findings.cjs. V1: 1-2/3, or output fails validation, or a decoy confirmed. F: completed run with 0/3.
  V0: the run cannot complete within the free model quota (~50 requests/day) / time box (until 09:30 UTC+8).