# Upstream provenance

Vendored from [cloudflare/security-audit-skill](https://github.com/cloudflare/security-audit-skill), directory `skills/security-audit`, at commit `c1c8a8c1471069fb0e188eeaff69b8e8db6564a8`.

Copyright (c) 2025-2026 Cloudflare, Inc. Distributed under the MIT license; see [LICENSE](LICENSE).

All upstream companion files, schema, validators, and validator tests are included unchanged. `SKILL.md` adds Selesai-specific delegation and sandbox guidance under **Selesai Code**. Updates are manual and pinned, not downloaded at runtime.

Run the upstream validator checks from the repository root:

```sh
node --test src/skills/security-audit/validate-findings.test.cjs src/skills/security-audit/validate-coverage-ledger.test.cjs
```