Cloudflare Security Audit Skill
Six-phase AI security audit with independently verified, machine-readable findings
About
A single-skill package from Cloudflare that turns a coding agent into a security auditor. It runs a structured six-phase audit: reconnaissance with a coverage ledger, coverage-led hunting by isolated sub-agents, adversarial candidate validation where a fresh verifier tries to disprove each finding, structured machine-readable output, independent record verification, and target-neutral reporting. Findings land in findings.json with three verdicts: confirmed, needs_validation, and rejected. This is the skill that seeded Cloudflare's internal vulnerability discovery harness. Honest limits: full runs are token-heavy (one Hacker News commenter reported around 1M tokens on a medium codebase; individual report, not a Cloudflare figure); it needs an OS-enforced sandbox for executing target code safely; and Cloudflare notes a single run finds roughly half of what repeated runs find, so runs are designed to be additive. Install with: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit. MIT licensed; 28,994 GitHub stars at time of research.
What it can do
- Six-phase security audit orchestration; coverage ledger tracking; adversarial finding validation; machine-readable findings with schema validation; audit reporting.
Setup
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit
Prerequisites
A coding agent with tool use and parallel sub-agents; Node.js for the bundled validators; an OS-enforced sandbox for full audit mode.
Use cases
Works with
Trust score — 9/10
Scored 9/10 (verified tier, metrics-v1). Evidence: Official Cloudflare repo page read this session: 28,994 stars, MIT, single-skill package.; Install command copied verbatim from README: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit.; Six-phase workflow and findings.json verdicts taken verbatim from README.; Caveats documented: token-heavy runs (HN commenter figure flagged as individual report, not Cloudflare's); sandbox requirement; additive multi-run design per Cloudflare..
★ 28,994 GitHub stars
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.