5 views
cloudflare/security-audit-skill
A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings
JavaScript★ 47,270+2,878 that day#6 on trending
C58.1/100
Duplication57
9.1% in javascriptDead code89
0%Complexity39
100% The score is jscpd's own --health model: markup, data and text left out, tests kept. The numbers below are the trending scan's.
8.19%duplicated over all files · 468 of 5,713 lines
28clones
38files scanned
Most complex files
Dead code 0% unused · 0 findings
No dead code found — everything here is reachable.
Only 2 of the files count as code, too few for a code-only percentage; the numbers above cover every file.
Largest clones in the code
- 32 lines in 2 placesjavascript199 tokensskills/security-audit/validate-coverage-ledger.cjs:92–123skills/security-audit/validate-findings.cjs:55–86
92const hasOwn = (value, key) => Object.prototype.hasOwnProperty.call(value, key); 93 94class JsonStructureError extends Error {} 95class SafeInputError extends Error {} 96 97function escapeUnsafeDiagnosticCharacters(value) { 98 return String(value).replace(UNSAFE_DIAGNOSTIC_CHARACTER, (character) => { 99 const codePoint = character.codePointAt(0); 100 return codePoint <= 0xffff 101 ? `\\u${codePoint.toString(16).padStart(4, "0")}`First 10 of 32 lines.
- 23 lines in 2 placesjavascript122 tokensskills/security-audit/validate-coverage-ledger.cjs:318–340skills/security-audit/validate-findings.cjs:138–160
318 return errors; 319} 320 321function hasValidUnicodeScalarValues(value) { 322 let index = 0; 323 while (index < value.length) { 324 const first = value.charCodeAt(index++); 325 if (first >= 0xd800 && first <= 0xdbff) { 326 if (index >= value.length) return false; 327 const second = value.charCodeAt(index++);First 10 of 23 lines.
- 16 lines in 2 placesjavascript109 tokensskills/security-audit/validate-coverage-ledger.cjs:718–733skills/security-audit/validate-findings.cjs:601–615
718 return errors; 719} 720 721function readFileWithinLimit(file) { 722 const noFollow = fs.constants.O_NOFOLLOW; 723 const nonBlock = fs.constants.O_NONBLOCK; 724 if (!Number.isInteger(noFollow) || noFollow === 0 || !Number.isInteger(nonBlock) || nonBlock === 0) { 725 // Node exposes no race-safe fallback on these platforms, so reject all inputs. 726 throw new SafeInputError("OS no-follow and nonblocking input protection is unavailable"); 727 }601 return schema; 602} 603 604function readFileWithinLimit(file) { 605 const noFollow = fs.constants.O_NOFOLLOW; 606 const nonBlock = fs.constants.O_NONBLOCK; 607 if (!Number.isInteger(noFollow) || noFollow === 0 || !Number.isInteger(nonBlock) || nonBlock === 0) { 608 throw new SafeInputError("OS no-follow and nonblocking input protection is unavailable"); 609 } 610First 10 of 16 lines, the second copy on the right.
6 more
- 18 lines in 2 placesjavascript87 tokens
- 15 lines in 2 placesjavascript72 tokens
- 8 lines in 2 placesjavascript64 tokens
- 13 lines in 2 placesjavascript61 tokens
- 7 lines in 2 placesjavascript52 tokens
- 6 lines in 2 placesjavascript50 tokens
Largest clones over all files, tests and data included
- 34 lines in 2 placestextdocs and examples399 tokens
102Artifact promotion procedure (trusted parent-side code only): 103Reference only for you: the parent performs these steps; you never perform them. 104 105Before execution, the parent opens and retains trusted, non-inheritable directory 106descriptors for the agent's scratch/ and artifacts/ roots, and records an allowlist 107of expected scratch-relative artifact files plus explicit per-file and cumulative 108byte limits. Never pass those descriptors to the agent or sandbox. After the sandbox 109and all its processes terminate, trusted parent-side code promotes each allowlisted 110file separately: 111First 10 of 34 lines.
- 80 lines in 2 placesjsondata files268 tokens
253}, 254"fingerprint": { 255 "type": "string", 256 "minLength": 1, 257 "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$" 258}, 259"title": { 260 "type": "string", 261 "minLength": 1, 262 "visibleContent": trueFirst 10 of 80 lines.
- 64 lines in 2 placesjsondata files217 tokens
35"intended_behavior": { 36 "type": "string", 37 "minLength": 1, 38 "visibleContent": true 39}, 40"trace": { 41 "type": "array", 42 "minItems": 1, 43 "uniqueItems": true, 44 "items": {First 10 of 64 lines.
- 32 lines in 2 placesjavascript199 tokens
- 7 lines in 3 placesjavascripttests80 tokens
By format, code only
| Format | Files | Lines | Clones | Duplicated lines | Duplication |
|---|---|---|---|---|---|
| javascript | 2 | 1,645 | 9 | 138 | 8.39% |
By format, all files
| Format | Files | Lines | Clones | Duplicated lines | Duplication |
|---|---|---|---|---|---|
| javascript | 4 | 3,037 | 24 | 276 | 9.09% |
| json | 3 | 537 | 3 | 160 | 29.8% |
| text | 13 | 248 | 1 | 32 | 12.9% |
| markdown | 16 | 1,884 | 0 | 0 | 0% |
| bash | 1 | 5 | 0 | 0 | 0% |
| yaml | 1 | 2 | 0 | 0 | 0% |
Trending appearances
| Day | Rank | Stars | Files | Lines | Clones | All files | Code | Health | Commit |
|---|---|---|---|---|---|---|---|---|---|
| Oct 26, 2026 | #6 | 47,270 (+2,878) | 38 | 5,713 | 28 | 8.19% | — | C 58.1 | c1c8a8c |
| Oct 25, 2026 | #1 | 45,041 (+2,264) | 38 | 5,713 | 28 | 8.19% | — | C 58.1 | c1c8a8c |
| Oct 24, 2026 | #1 | 42,490 (+2,716) | 38 | 5,713 | 28 | 8.19% | — | C 58.1 | c1c8a8c |
| Oct 23, 2026 | #2 | 39,976 (+2,979) | 38 | 5,713 | 28 | 8.19% | — | C 58.1 | c1c8a8c |
| Oct 22, 2026 | #1 | 37,138 (+2,012) | 38 | 5,713 | 28 | 8.19% | — | C 58.1 | c1c8a8c |
| Oct 21, 2026 | #1 | 34,596 (+1,712) | 38 | 5,713 | 28 | 8.19% | — | C 58.1 | c1c8a8c |
| Oct 8, 2026 | #6 | 26,197 (+576) | 48 | 6,575 | 28 | 7.12% | — | C 60.9 | c1c8a8c |
| Sep 21, 2026 | #2 | 18,253 (+2,428) | 48 | 6,531 | 28 | 7.17% | — | C 61.6 | c1c8a8c |
| Sep 20, 2026 | #1 | 16,736 (+3,155) | 48 | 6,531 | 28 | 7.17% | — | C 61.6 | c1c8a8c |
| Sep 19, 2026 | #1 | 14,150 (+3,006) | 48 | 6,531 | 28 | 7.17% | — | C 61.6 | c1c8a8c |
| Sep 18, 2026 | #2 | 11,067 (+3,607) | 48 | 6,531 | 28 | 7.17% | — | — | c1c8a8c |
| Sep 17, 2026 | #2 | 7,788 (+927) | 48 | 6,531 | 28 | 7.17% | — | — | c1c8a8c |
Want this for your own project? Install jscpd and run jscpd ., or measure it the way the baselines were measured.