Ask a coding agent to audit your code and it will happily hand you a long list of possible vulnerabilities. The problem is that half of that list is usually wrong, and you have no easy way to tell which half. Cloudflare's open source security-audit skill fixes that problem with a simple rule: the agent that checks a finding is never the agent that found it.
Key Takeaways
>
The skill runs a 6-phase audit: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.
Every finding is verified by a fresh agent that tries to disprove it, so confirmed findings carry real evidence.
Output is machine-readable: `findings.json` with `confirmed`, `needs_validation`, and `rejected` records, plus human-readable reports.
It is agent-neutral, MIT licensed, and installable with one command: `npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit`.
The repo has 45,971 stars and 2,854 forks on GitHub as of October 25, 2026.
Where the skill came from
The skill did not start as a public product. In a June 2026 post on the Cloudflare Blog, Cloudflare described how a roughly 450-line `security-audit` skill, first run on a single repository, grew in about 6 weeks into a fleet scanner covering 128 distinct repos. That skill seeded Cloudflare's internal vulnerability discovery harness, and Cloudflare released the skill itself at the end of the same post.
The harness numbers show why verification mattered to Cloudflare. From 20,799 raw candidates, about 12,057 survived validation, and after duplicates and wrong-repo or low-risk items were folded away, 7,245 actionable findings remained. The rejection share fell from 40 percent to 11 percent as the harness matured. The public skill carries the same philosophy into a form any developer can run: find a lot, then prove what you found.
Watch the 30-second repo signal: Cloudflare Open Sourced Their AI Security Audit Tool.
The 6 phases, and why the order matters
Most agent audits jump straight to hunting for bugs. This skill starts slower, and that is the point.
1. Reconnaissance
The agent maps the codebase first: architecture, entry points, trust boundaries, and data flows. The output is an `architecture.md` file that later phases use as their map.
2. Coverage-led hunting
Hunting is driven by a coverage ledger, not by vibes. The agent works through attack classes systematically, including memory safety, web protocol and auth, client-side issues, supply chain and release, cloud and deployment, and AI and LLM weaknesses. The ledger records what was covered, so gaps are visible instead of hidden.
3. Candidate validation
Candidates are not findings yet. Each one is checked against the code to see whether it is real, and whether it has genuine impact. Severity follows impact, calculated as likelihood times impact, not mere deviation from a checklist. A defense-in-depth gap on its own is recorded as a hardening note, not a vulnerability.
4. Structured output
Validated candidates become structured records in `findings.json`, checked against a schema by two zero-dependency validators, `validate-findings.cjs` and `validate-coverage-ledger.cjs`. This makes the output usable in CI pipelines and dashboards, not just readable in chat.
5. Independent record verification
This is the phase that sets the skill apart. Every unique candidate goes to a fresh verifier agent that tries to disprove it. The verifier did not find the bug, so it has no stake in defending it. Only findings that survive this adversarial check earn the `confirmed` verdict.
6. Target-neutral reporting
The final reports, `REPORT.md`, `FINDINGS-DETAIL.md`, and `NEEDS-VALIDATION.md`, are written without assuming a particular target or fix. Findings that could not be executed safely stay in `needs_validation` rather than being dressed up as confirmed.
Two modes, and one hard safety rule
By default the skill runs in guidance mode: it advises and does not kick off a full workflow or create files on its own. Full audit mode starts only when you explicitly ask for an audit, a penetration test, a comprehensive review, or report artifacts. That distinction matters, because a full audit is a heavy operation, not a casual question.
The hard safety rule is the sandbox. Target-controlled builds, tests, and fuzzers must run inside an OS-enforced sandbox with external networking disabled. Without that sandbox, the skill will not execute target code, and the lead stays `needs_validation`. That is a feature, not a limitation: running untrusted code from the thing you are auditing is exactly how an audit tool becomes an attack vector.
Aspect | Typical agent audit | Cloudflare security-audit skill |
|---|---|---|
Finding quality | Long list, mixed accuracy | Candidates filtered by validation and independent verification |
Coverage | Whatever the agent felt like checking | Coverage ledger tracks attack classes systematically |
Output | Chat text | Machine-readable `findings.json` plus three report files |
Verdicts | Confirmed or not, loosely | `confirmed`, `needs_validation`, `rejected` |
Safety | May run target code freely | OS-enforced sandbox required, networking disabled |
What you need to run it
The requirements are modest but specific. You need a coding agent whose model supports tool use and parallel sub-agents, because the verification phase depends on fresh agents. You need Node.js for the validators. And you need that OS-enforced sandbox for anything that executes target code. The skill itself is agent-neutral: the README states the generic requirements rather than tying itself to one vendor's agent, and the skills.sh listing describes the same agent-neutral, defensive, source-first design.
One honest caveat from the README itself: a single run found roughly half of the vulnerabilities that repeated runs found in total. Audits are sampling, not proof of absence. If a first pass comes back clean, that is evidence, not a guarantee, and repeated runs are part of the workflow, not a sign it failed.
Why this skill matters
AI coding assistants made it cheap to generate code, and cheap to generate security findings. Cheap findings are the problem: they bury real bugs under false alarms until developers stop reading reports at all. Cloudflare's skill attacks the trust problem directly, with a workflow where every confirmed finding had to survive someone trying to kill it.
For solo developers, it turns a vague "audit my code" prompt into a repeatable, checkable process. For teams, the machine-readable output means audit results can feed triage, tracking, and CI gates instead of dying in a chat log. And for the open source ecosystem, a 45,971-star MIT licensed tool from a company that runs one of the largest networks on the internet is a strong signal that agent-driven security auditing is moving from demo to discipline.
Read this article in Indonesian: Skill Audit Keamanan Cloudflare: Ubah Coding Agent Menjadi Auditor Keamanan yang Teliti.
FAQ
Is the security-audit skill really free?
Yes. The repository is MIT licensed and the skills.sh listing shows a price of 0 USD. You still need your own coding agent and model access, which may cost money depending on your setup.
Which coding agents does it work with?
The skill is agent-neutral. It requires a coding agent whose model supports tool use and parallel sub-agents, since independent verification depends on fresh verifier agents. It is not tied to a single vendor's agent in the README.
What does "independently verified" actually mean?
Every candidate finding is handed to a fresh agent that did not find it, and that verifier tries to disprove it. Only findings that survive that check are marked `confirmed`. Findings that cannot be safely executed stay `needs_validation`.
Do I need a sandbox to use it?
For full verification, yes. Target-controlled builds, tests, and fuzzers must run in an OS-enforced sandbox with external networking disabled. Without one, leads remain `needs_validation` instead of being confirmed.
Can one run prove my code is secure?
No. The README notes that a single run found roughly half of the vulnerabilities that repeated runs found in total. Treat a clean run as useful evidence, not a guarantee, and run audits repeatedly.
How do I install it?
Run `npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit`, adding `--global` for a user-level install. A default full-audit run writes output to `~/security-audit-skill/<repo-name>/run-<N>`.