Cloudflare open-sourced its security audit skill for coding agents

Cloudflare published security-audit-skill, the starting point of the harness they use internally to find vulnerabilities. It turns your coding agent into a multi-phase security auditor, and it's MIT licensed.

How an audit runs

• Recon: map the architecture, trust boundaries and every input surface.

• Hunting: isolated sub-agents each take a slice of the codebase, and critics look for the gaps they missed.

• Validation: a fresh verifier tries to disprove every candidate finding.

• Structured output: findings land in findings.json as confirmed, needs validation or rejected, checked against a schema.

• Re-verification and report: independent agents re-check the claims, then it writes REPORT.md and the details.

The part I like most: findings are machine-readable and every one has been attacked by a second agent before it reaches you. Fewer false alarms to wade through.

Install

npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

Add --global to install it for your user. Then open your agent in the repo and ask it to "security audit this codebase".

Worth knowing

• It needs a model with tool use and parallel sub-agents, plus Node.js for the validators.

• If the audit will build or run your code, give it an OS-level sandbox. Without one it keeps those leads as "needs validation" instead of executing anything.

• Runs are additive. The README says a single run found about half of what repeated runs found, so run it more than once on code that matters.