Integrating Cloudflare's 37k-Star Security Audit Skill into Claude Code: A Practical Plan from Full-Scan Cost Burn to On-Demand Trimming

I maintain the multi-platform content distribution tool Ziliu. Over the past year, it accumulated 192 commits.

The inbox absorbed more than 1,300 comments and private messages.

The AI tools supporting all of this cost about 17,000 yuan per year in subscriptions.

If you run a complete enterprise-grade six-phase security audit Skill in Claude Code without trimming it, the token bill from a single run of concurrent sub-agents will break through the budget floor of a one-person company.

This post is not about the grand narrative of the open-source ecosystem.

I'm going to break down how to integrate Cloudflare's open-source security-audit-skill into Claude Code, and how to trim the workflow around the core exposure surface of an overseas product so it doesn't consume quota without limit.

Over the past two days, the tech world saw a landmark event.

On October 22, 2026, Anthropic announced it was donating the open standard Agent Skills to AAIF, which sits under the Linux Foundation. FourWeekMBA reported on October 23 that the standard has seen 1 million skills published and nearly 280 million cumulative installs. It supports more than 70 agent platforms, including ChatGPT, Cursor, GitHub Copilot, and VS Code.

The same day, AAIF announced four new hosted projects: Anthropic's Agent Skills, OpenAI's Open Responses, Hugging Face's OpenEnv, and Alibaba's OpenSandbox. The foundation, co-founded by Anthropic, Block, and OpenAI at the end of 2025, gathered 10 core hosted projects in its first year.

Many developers, seeing the foundation take over, first worry that local configuration will break. But looking at the list OrcaRouter put together on October 23, the four named assets transferred are limited to the name, logo, GitHub organization, and the agentskills.io domain. It comes with two named principal maintainers and three proposed roadmap projects.

For people writing code on the front line, the skill's loading mechanism, folder format, and runtime interface are unchanged. We can keep using the standard without joining any organization.

What's actually worth a one-person company doing right now is taking advantage of the neutralized underlying spec to install big-tech-verified, industrial-grade Skills into its own workflow.

An Overseas Product from a One-Person Company Can't Afford a Full Scan

My daily coding environment is Codex paired with Claude Code.

Besides maintaining Ziliu, I'm also running the overseas product Kirkify under the US entity Nextfield Labs LLC, and the website generator project ShipSite. After leaving a big company at the end of September 2025 to go full-time indie, I've become clearer about one thing: building a product is not the same as owning a business.

Holding the business's bottom line means safety margin and cost control. When independent developers do commercial delivery, they often throw all their energy into feature iteration or wiring up Stripe and PayPal payments. Security risks in the codebase get nothing more than a casual glance.

Once the product has real overseas paying users, even if I've received payment from 1,000 people, I often think about the real picture behind those 1,000 numbers. I imagine one of them sitting in a rented room of around a dozen square meters, late on a rainy night. He just ran a batch of overseas web pages with my tool and is about to bind a credit card to start a subscription. If, at that moment, the auth endpoint is missing a layer of tenant isolation, or the webhook signature validation has a flaw, and his configuration data and billing information are exposed, what's lost isn't a few lines of code; it's the user's complete trust in you.

So the question is, what should a small team do? There's no energy for manual auditing, and hiring a third-party security team for penetration testing blows the budget. Stuffing automated security auditing into the coding agent you use every day becomes the natural solution.

That's exactly why Cloudflare's open-source cloudflare/security-audit-skill has hit the trending charts recently.

Speaking of which, many news accounts have been calling it a newly open-sourced project these past two days. As fireup.pro's October 21 report makes clear, Cloudflare open-sourced this skill back in June 2026 alongside a blog post. It's MIT-licensed and free for commercial use, and in September 2026 the workflow, result format, and validators were refactored.

The code, initially about 450 lines, grew within roughly six weeks at Cloudflare into a vulnerability discovery framework that continuously scans its 128 codebases. The complete cluster-level framework has not been made public, though. By early October it had 25.6k GitHub stars; on October 20 it passed 33,000. As of October 22 it had reached 37,000 stars, growing at roughly 2,000 stars per day and ranking No. 2 on the global trending list.

But before you blindly stuff the whole thing into your codebase, I have to add a qualifying caveat. explainx.ai's October 7 breakdown noted that Cloudflare has not published the skill's accuracy, false-positive rate, or per-run token cost. It also hasn't said which specific models perform best, only that it switches between different models during the discovery and validation phases.

If you move a big company's heavy weapon, built for scanning 128 repositories, unchanged into a one-person company's project, the first thing you face isn't how many vulnerabilities it catches. It's a real accounting problem.

Where the Six-Phase Workflow Actually Gets Expensive

Why do I say running the full thing mindlessly burns through the budget? You have to look at the underlying architecture after the September 2026 refactor of security-audit-skill.

It's written in an agent-agnostic way. As long as your coding agent supports tool calling and parallel sub-agents, like Claude Code, which I use heavily, it can drive the skill directly. It ships with two zero-dependency validators that run as long as you have a local Node.js environment.

At runtime, the skill is strictly divided into a six-phase workflow, including reconnaissance, coverage-driven hunting, candidate validation, structured output, and independent record verification. Its audit surface is very wide, covering eight major security dimensions in one pass:

1. Web and authentication protocols
2. Client-side code
3. Cloud and deployment
4. Supply chain and CI
5. RPC and messaging
6. Inter-tenant data isolation
7. Native and mobile apps
8. AI and LLM-specific files

Let's do a detailed cost calculation. Suppose you want to do a full scan of my project with 270,000 lines of code written in three months and nearly 3,000 commits. Or a full audit of a multi-platform distribution system like Ziliu.

When Claude Code wakes up parallel sub-agents to run the 'coverage-driven hunting' phase, each sub-agent has to pull in context for its corresponding module. They run multiple rounds of reasoning against the rule files for all eight dimensions. After generating candidate vulnerabilities, they hand them to the next phase's validators for a second pass.

So where's the problem? Sub-agents will repeatedly search for native app configuration in a web project that has no mobile code at all. Models stuff large static stylesheets and layout code into context to compare against RPC messaging vulnerabilities. In the candidate validation phase, a low-risk dependency warning can trigger multiple rounds of cross-review by different models. These costs aren't just wasteful; they're extremely expensive.

A tool supporting full automation doesn't mean we have to run it in full. Rather than how wide the tool's coverage boundary is, I care more about which paths your business delivery is actually exposed on. This is also the underlying logic I've always agreed with. As Kazuo Inamori put it: maximize sales, minimize expenses.

In a one-person company's code pipeline, tokens are your direct production cost. Any context throughput that doesn't create real security margin is pure loss.

Practical On-Demand Trimming for the Ziliu Architecture

This is the integration and trimming approach I worked out myself. It may not fit every team size. If you also use Claude Code to maintain an overseas product or independent project, you can test locally with the steps below.

First, confirm the local environment. Agent Skills' folder format and loading interface remain exactly the same after the donation to AAIF. The two zero-dependency validators in security-audit-skill only need Node.js. Before integrating, just make sure a local Node environment is ready and clone the skill repository into the project's skills directory.

You can initialize the environment in the terminal and look at its rule file structure like this:

# 1. Confirm the local Node.js environment (for running the two zero-dependency validators)
node -v

# 2. Clone Cloudflare's MIT open-source audit skill to a local directory
git clone https://github.com/cloudflare/security-audit-skill.git .claude/skills/security-audit

# 3. View the rule categories and validator scripts under the skills directory
ls -la .claude/skills/security-audit

After pulling the code, don't let Claude Code run the full six-phase audit against the root directory.

Take our product Ziliu and our overseas projects as an example; the system's core architecture is clear. The frontend is a content editing and multi-platform distribution interface. The backend handles user authentication, tenant isolation, AI prompt scheduling, and overseas payment callbacks. The underlying AI agent architecture deploys Hermes on a remote Linux server, coordinated and scheduled from a local Windows machine.

Think about it: in this architecture, we have no native or mobile application code at all. There's also no complex internal heavy RPC cluster.

To make the security check after every commit controllable and accountable, I put together a set of exclusive audit-phase state codes. You can write these admission and exit standards into the project's CLAUDE.md or custom instructions. This forces the coding agent to move forward by state and forbids it from inventing extra authority.

# Security Audit Execution Rules (write into CLAUDE.md)

When you call `security-audit-skill` for a security check, you must strictly follow the admission and exit standards of the following four exclusive state codes. If the admission conditions are not met, you must not trigger the next phase:

- [STATE_01: RECON_SCOPED] (scoped reconnaissance)
  - Admission: only trigger when `git diff` involves authentication, payment callbacks, tenant data queries, or LLM prompt-assembly directories.
  - Execution boundary: only load the three rule files for "Web and authentication protocols", "Inter-tenant data isolation", and "AI and LLM features"; explicitly ignore mobile, native, and static layout modules.
  - Exit: output a list of affected core files (maximum 15 files); if there are no hits, terminate the process directly and do not enter the hunting phase.

- [STATE_02: HUNT_TARGETED] (targeted vulnerability hunting)
  - Admission: the affected file list from `STATE_01` has been obtained.
  - Execution boundary: the maximum number of concurrent sub-agents is 2, and static path tracing is performed only on the files in the list.
  - Exit: generate a candidate vulnerability list with specific file line numbers and trigger paths.

- [STATE_03: VERIFY_LOCAL] (local zero-dependency verification)
  - Admission: the candidate list contains high- or medium-severity permission bypass, injection, or cross-tenant privilege escalation items.
  - Execution boundary: call the skill's built-in Node.js zero-dependency validator to verify the structured results and records, and remove theoretical false positives that cannot construct an actual call chain.
  - Exit: pass the Node.js validator and generate a standardized structured output report.

- [STATE_04: AUDIT_ABORT] (circuit breaker and exemption)
  - Admission: the cumulative context read for a single audit exceeds the set threshold, or only pure frontend UI / Feishu-to-Markdown layout logic has been modified.
  - Action: immediately suspend sub-agents and exit the audit workflow, recording the reason for skipping.

With this state-machine-style hard constraint, you can use explicit instructions in Claude Code to control scan granularity. For example, when we update the private-message handling logic in the user inbox, or the overseas subscription status sync interface, we only trigger an audit for the specific module and run the local Node.js validator directly to check the result format.

# In the Claude Code interactive terminal, run with a specified scope instead of a full repository scan
claude "Please load .claude/skills/security-audit, strictly follow the [STATE_01] to [STATE_03] standards in CLAUDE.md, perform a security audit only on the src/auth and src/llm-agent directories, and use the built-in Node.js validator to verify the output."

[To be added: terminal output screenshot and single-run token consumption numbers after running the trimmed security-audit-skill on specified directories in Ziliu or overseas projects]

After breaking down this toolchain, who should actually integrate it? My judgment depends entirely on your code's exposure surface and your current commercial delivery stage.

If you have real overseas payment and multi-tenant logic, I recommend integrating it immediately. As long as the system has Stripe or PayPal webhooks connected, or stores configuration data for different users, targeted checks of "Web and authentication protocols" and "Inter-tenant data isolation" can stop low-level unauthorized access mistakes.

Commercial applications with heavy LLM integration are also recommended for integration. If your product has complex prompt assembly, external tool calls, or uses Hermes on a remote Linux server for agent scheduling, the "AI and LLM features" rules can help you catch prompt injection and unauthorized tool execution risks early.

High-frequency iterative AI-assisted development projects apply as well. When you generate code at high frequency every day with Codex and Claude Code, the AI often gets features working but misses boundary checks. A targeted review at key commit points is much more reliable than manually reading through a diff line by line.

But for pure static sites, local scripts, or pure layout tools, I don't recommend installing it just to follow the trend. For example, the Feishu-to-Markdown layout tool I open-sourced earlier doesn't involve multi-tenant database isolation or complex server-side authentication. Forcing a six-phase enterprise security audit on it is pure token waste.

Teams that are used to not trimming their workflows and expect one-click full automation should also stay away. If you don't plan to remove any of the eight dimensions based on your business, and don't limit the sub-agents' scan directories, then without official cost baselines and false-positive metrics, the bill shock from a full scan will most likely outweigh the real problems it finds.

I've laid out this evaluation standard and configuration logic without holding anything back. Take it if it's useful.

Back to the earlier question: today's evolution of AI programming closely overlaps with the open-source infrastructure movement of more than twenty years ago. When big companies donated private components and turned them into neutral standards back then, it wasn't so small teams could run every kernel module at full blast. It was to lower the migration cost of tools.

Anthropic donated Agent Skills, with nearly 280 million installs, to AAIF. Cloudflare turned a 37,000-star security audit capability into a general-purpose MIT open-source skill. In essence, both turn weapons that only big-company security departments could afford into public building blocks. The more accessible the building blocks, the more restraint the person at the helm needs.

The 17,000 yuan annual AI subscription cost doesn't look high. But it's saved through every restrained call and every subtraction of invalid context.

In the next stage, I'll keep focusing on the 'ShipSolo AI Programming Overseas Navigation Plan' (shipsolo.cn) and polishing the business loop of my own overseas products. I'll keep accumulating engineering practices that carry real bills and safety margins.

Today, you can open your own project's codebase directly. Compare the eight audit dimensions above, delete the rule files unrelated to your business, pick only the most core auth or payment directories, and run a targeted test.

If this practical breakdown saves you unnecessary test quota, you're welcome to like and bookmark it. For Claude Code cost control and security pitfall avoidance in overseas projects, if you have a better trimming approach, or want the practical checklist of overseas pitfalls and account-ban avoidance that I put together, let's talk in the comments.

---

👋 I'm Meng Jian, former Tencent T11, former ByteDance technical leader, now working full-time on AI programming.

🔥 More AI programming practice:

• GitHub: @mengjian-github
• Column: AI Programming Practice

Found it useful? Like + bookmark is the biggest support 🙏

This article was organized with the help of AI, and the content was tested and reviewed by the author.