Cloudflare's security-audit-skill has 45,592 stars on GitHub. The Chinese translation was published today and has zero. That gap is the whole reason the translation exists — not because the original is hard to read for everyone, but because a security workflow is one of the few things where misreadi
ng a sentence changes what you actually run. The Chinese version lives at yangshun2005/security-audit-skill-cn. It is a translation of cloudflare/security-audit-skill, MIT licensed, original language JavaScript, translation dated 2026-10-25. The original README is kept as README_en.md so you can diff the two.
It turns a coding agent into a security auditor. Not by prompting "find bugs" harder, but by forcing a six-phase process where different agents do different jobs and the one who finds a candidate is not the one who confirms it. The six phases, as listed in the README: Reconnaissance — map architecture, trust boundaries, input surfaces, existing evidence, and deterministic coverage into architecture.md and coverage-ledger.json. Coverage-driven hunting — assign isolated hunters from ledger units, record what they checked, and use a coverage reviewer to find gaps.
Candidate validation — hand each unique candidate to a fresh validator whose job is to falsify it. Structured output — write confirmed, needs_validation, and rejected records to findings.json, validated against report-schema.json. Independent record verification — a fresh agent verifies final source claims. Substantive replacements go through another independent validator.
Target-neutral reporting — generate REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from verified records and the coverage ledger. The three verdicts are deliberately distinct. confirmed means full source tracing plus bounded observation. needs_validation means there is a specific unresolved fact and no severity assigned.
rejected records a candidate that was disproven. That last one matters — a rejected candidate is data, not noise, because it tells the next run what not to re-hunt. Two Node scripts enforce the shape of the output. The parent runs validate-coverage-ledger.cjs after creating the ledger and after every update to it.
validate-findings.cjs runs in phase 4, and again in phase 5 after each replacement. Most translated READMEs are a convenience. This one is closer to a prerequisite, for three reasons. The sandbox requirement is a hard gate, and it's easy to skim past.
The skill needs an OS-enforced sandbox to run builds, tests, processes, browsers, emulators, fuzzers, and fixtures against the target code. That sandbox must have external network disabled, a sanitized allowlist environment, enforced resource limits, and write access only to designated temp paths. Without those controls, the workflow keeps the relevant leads at needs_validation instead of executing target code. A reader who half-understands this will run the skill, get a shallow audit, and conclude the tool doesn't work.
The Chinese quick-start section states this plainly as a "常见坑" — a common pitfall — before you get to the workflow. The default output path is not obvious. In full audit mode, if you don't specify an output directory, results go to ~/security-audit-skill/ /run- (that spacing appears in the source). The workflow only writes inside the target repo when you explicitly pick a directory that version control ignores.
If you're auditing a repo you care about, getting this wrong is annoying at best. One run does not cover everything. The original README states that a single run finds roughly half of the vulnerabilities that repeated runs find in total. Runs are additive. The recommendation is to run the skill multiple times against the same repository. Someone who reads this as "run once, get a report" will under-audit and never know. None of these are translation problems in the sense of wrong words. They're the kind of detail that gets lost when you're reading a long English document in a second language and pattern-matching for the install command.
The command is unchanged from the original: npx skills add https://github.com/cloudflare/security-audit-skill \ --skill security-audit For a user-level install, add --global: npx skills add https://github.com/cloudflare/security-audit-skill \ --skill security-audit \ --global Note that this pulls from the upstream repo, not the translation. The Chinese repo is documentation — the skill itself is the same code. npx skills --help covers agent selection and non-interactive options. Then open or point your coding agent at the codebase and ask: security audit this codebase Or with a target and output location: find security vulnerabilities in ./src do a security review, output to ~/audits/my-project The skill activates on trigger phrases like "security audit", "find vulnerabilities", and "pen-test the code".
If you're on a network where GitHub fetches are slow, the Chinese README flags this directly: you may need an npm mirror or a proxy for the npx skills add step. Small thing, but it's the first thing that fails. Confirmed dependencies: A coding agent and model that support tool use and parallel sub-agents. Node.js, for the zero-dependency findings and coverage-ledger validation scripts. The parallel sub-agent requirement is structural, not cosmetic. The design depends on isolated agents doing separated work — hunters, a coverage reviewer, fresh validators, an independent record verifier. If your agent or model can't spawn parallel sub-agents, the workflow can't run as designed. The README does not describe a fallback.
Things the original README does not specify, and the translation honestly leaves as "原文未说明" rather than inventing answers: supported operating systems, hardware requirements, and the specific Node.js version. If you need those, you'll have to determine them yourself. I'd rather see a translation that admits the gap than one that fills it in. The skill is split across files by phase, which is a decent signal of how much process is packed in: File Purpose SKILL.md Setup, core principles, platform terminology, workflow overview, audit anti-patterns RECONNAISSANCE.md Phase 1 recon prompts and synthesis instructions HUNTING.md Phase 2 orchestration, hunting methods, validation rules ATTACK-CLASSES.md Attack prompts for core, wildcard, and obvious-issue categories MEMORY-SAFETY-AND-BINARY.md Memory safety, binary, and kernel work for native targets The existence of MEMORY-SAFETY-AND-BINARY.md is worth noticing.
This is not only a web-app scanner. It has guidance for native targets. The skill is the single-repository starting point of Cloudflare's vulnerability discovery framework, described in their post Build your own vulnerability harness. That framework later grew into a multi-stage, fleet-wide system.
What you install here is the origin version, not the fleet version. Worth knowing before you compare it to anything Cloudflare has written about at scale. The repo is structured so you can check the work. The Chinese page opens with a "中文快速上手" section that is explicitly marked as supplementary guidance, not part of the original document — it covers what the project is, the shortest install path, environment requirements, and the pitfalls above.
Below that, the README body is a translation that aims to stay faithful to the original. The English original sits alongside as README_en.md. That separation is the right call. A translation that quietly blends a translator's opinions into the source text is worse than no translation, because you can't tell which claims are the project's.
Here the boundary is stated on the page. The repo also asks for issues and PRs on inaccurate translations, which is the only realistic way this gets better. My sample of one reading is not a review; if you find a phase description that reads wrong against the English, that's a bug worth filing. If you already read English technical documentation comfortably, use the upstream repo — it will always be current, and the translation is dated 2026-10-25, so it will drift.
If you or your team would otherwise skim the sandbox and multi-run caveats, the Chinese version is the difference between running this skill correctly and running it once, getting a thin report, and moving on. The star count on the translation is zero. That's fine. The thing it translates has 45,592, and the value here is comprehension, not popularity. Chinese documentation: https://github.com/yangshun2005/security-audit-skill-cn I'm an independent enterprise AI delivery consultant — private LLM deployment, RAG, agent workflows, AIOps. If your team is stuck somewhere in that stack, my inbox is open.
Key Takeaways #
- •The Chinese version lives at yangshun2005/security-audit-skill-cn.
- •This story was reported by Dev.to , covering developments in thedev space.
- •AI advancements continue to reshape industries — read the full article on Dev.to for complete coverage.
📖 Continue reading the full article: