security-audit-skill

What it is

Security Audit Skill is a Cloudflare-built coding agent skill that evolved from their internal vulnerability discovery system. It orchestrates isolated agents through a six-phase structured audit: reconnaissance (mapping architecture, trust boundaries, and input surfaces), coverage-led hunting (assigning isolated hunters to ledger units), candidate validation (fresh verifiers attempt to disprove each finding), structured output (writing findings with confirmed/needs_validation/rejected verdicts), independent verification (separate agents validate source claims), and target-neutral reporting (generating REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md). The skill's key design principle is adversarial validation -- different agents are responsible for finding and verifying vulnerabilities, reducing false positives. Severity is assessed based on likelihood times impact, and the skill confirms only established boundary failures rather than theoretical concerns. Each finding goes through a structured validation process where a separate agent with no knowledge of the original hunter's reasoning attempts to reproduce or disprove the issue. The skill requires an OS-enforced sandbox with networking disabled, resource limits, and restricted write paths for safe operation. It outputs findings in both structured JSON (findings.json) and markdown formats. The project is MIT licensed and contact for questions goes to security-ai-research@cloudflare.com. Multiple runs improve overall coverage as the skill is designed for iterative use.

Who it's for

• security engineers
• AppSec teams
• developers shipping code to production
• security researchers

Requirements

Setup

1. Step 1

   bashCopy

   npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

Examples

security audit this codebase

find security vulnerabilities in ./src

Pros & cons