[Zach Dunn (zachdunn)]

In plain terms

Agents working in this repo now load Cloudflare's security-audit skill when someone asks for a security audit, a vulnerability review, or a pen test. The skill was already used from a global install. This checks the same copy into the project so Claude Code, Codex, Cursor, and Grok pick it up here.

What it does / what it is not

• Installs security-audit from cloudflare/security-audit-skill and records it in package.json and skills-lock.json.
• Points AGENTS.md at that skill. The existing Workers rules stay as they are.
• Keeps one canonical copy in .agents/skills. Claude Code symlinks to it. Grok, Codex, and Cursor read .agents/skills, so there is no .grok copy.
• Keeps the skill out of the root skills/ directory, so uploads install does not ship it to users. docs-page-style stays where it is.
• Leaves the vendored files out of oxfmt and oxlint so the lock hash stays the upstream bytes.
• This does not change the product, the CLI, or any worker. There is no changeset. It also does not close the security review.

How to try it

From a checkout of this branch:

npx skills list

security-audit should show up for this project. A new agent session in the repo can load it for a security question. A full audit still needs an explicit audit request.

Technical notes

The canonical tree is .agents/skills/security-audit. Claude Code uses a relative symlink. Grok scans .agents/skills alongside .grok/skills, so this repo does not add a second link. Codex and Cursor read .agents/skills directly. npx skills experimental_sync restores the package.json skills entry into that tree.

Test plan

• skills-lock.json names only security-audit from cloudflare/security-audit-skill
• Root skills/ still has only github-screenshots, annotate-screenshots, and uploads-cli
• .claude/skills/docs-page-style is unchanged
• No .grok skill symlink in the repo
• Pre-commit pnpm types and lint-staged passed on the first commit
• CI lint and format

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3029449

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 2

• coderabbit:review
• review

🚫 Excluded labels (none allowed): 1

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a4d05900-8528-4bf5-92a9-e34bead38966

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn