Cloudflare · Security audit skill

Cloudflare security-audit skill

Cloudflare has published security-audit, a coding-agent skill that turns an agent into a security auditor for a single repository. It is the single-repo starting point from which Cloudflare's vulnerability discovery harness evolved, as described in the blog post 'Build your own vulnerability harness'. It runs six phases: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification and reporting. Isolated agents do each step, and the agent that checks a finding is never the one that found it. Findings are written as `confirmed`, `needs_validation` or `rejected` records, checked against a JSON schema by zero-dependency Node.js validators, and used to produce Markdown reports. The README says repeated runs are additive, and that in the authors' test runs a single run found roughly half of the vulnerabilities that repeated runs found in total. It needs an agent with tool use and parallel sub-agents, plus an OS-enforced sandbox for running target code. It is MIT-licensed with about 55,500 stars, installed through the Skills CLI, and has no tagged releases; the last push was 14 September 2026.