Cloudflare Security Audit Skill

Security Audit Skill is an open-source skill from Cloudflare that turns an AI coding agent into a security auditor. Published on GitHub with more than 35,000 stars under the MIT license, it runs structured, multi-phase code audits and produces independently verified, machine-readable findings.

Overview

Most AI code reviews are a single pass: one model skims the code and reports whatever it happens to notice, with no record of what was actually checked. Cloudflare’s Security Audit Skill takes a different approach. It orchestrates isolated sub-agents through six phases — reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting — so the codebase is mapped in a coverage ledger before any finding is accepted.

The workflow is the single-repo starting point that seeded Cloudflare’s own fleet-wide vulnerability discovery harness. Every candidate issue is handed to a fresh verifier agent whose job is to disprove it, and repeat runs are additive: prior ledgers and findings are reused to target gaps and revalidate changed code rather than starting over.

Key Features

• Six-phase audit workflow – Reconnaissance, hunting, validation, structured output, verification, and reporting run as separate stages handled by isolated agents.
• Three-verdict findings – Each candidate is classified as confirmed, needs validation, or rejected, and written to findings.json validated against a JSON schema.
• Coverage ledger – Architecture, trust boundaries, and input surfaces are mapped up front, so unexamined areas stay visible instead of silently skipped.
• Attack-class playbooks – Dedicated hunting guides cover web and authentication flaws, client-side bugs, cloud and deployment issues, supply-chain risks, memory safety, and LLM-specific attacks.
• Zero-dependency validators – Bundled Node.js scripts check the findings file and coverage ledger after each phase, with no extra packages to install.
• One-command install – Add the skill to a compatible coding agent with the Skills CLI, then simply ask it to security audit your codebase.

💳 Pricing

Security Audit Skill is completely free and open source under the MIT license. There is no paid tier, hosted version, or usage fee — you install the skill locally and run audits with your own coding agent and model.

Who Is It For

Security Audit Skill is for developers and security engineers who already work with an AI coding assistant such as Claude Code and want deeper, more trustworthy vulnerability reviews of their own codebases — from pre-release audits of security-sensitive services to repeat checks as the code evolves.