Cloudflare security-audit-skill: Open‑source multi‑phase security audit framework for coding agents

TL;DR

Cloudflare released an open‑source "security‑audit‑skill" that equips coding agents with a six‑phase, independently verified security audit pipeline, producing machine‑readable findings and immutable reports. The framework is designed for repeatable, additive audits of codebases and can be installed via the Skills CLI.

What the skill does – six concrete phases

The skill orchestrates isolated sub‑agents through a deterministic audit that ends in a signed report.

Reconnaissance – Generates architecture.md and coverage‑ledger.json describing trust boundaries, input surfaces, and prior evidence.
Coverage‑led hunting – Assigns hunters from the ledger, records each check, and uses critics to surface uncovered gaps.
Candidate validation – Sends every unique candidate to a fresh verifier that attempts to disprove it.
Structured output – Writes findings.json with three verdicts (confirmed, needs_validation, rejected) and validates the file against report‑schema.json.
Independent record verification – Fresh agents re‑verify final source claims; any material replacement triggers another independent check.
Target‑neutral reporting – Derives REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from the verified records and the coverage ledger.

Each phase runs a zero‑dependency validator (validate‑coverage‑ledger.cjs or validate‑findings.cjs) to guarantee schema compliance before proceeding.

How the workflow guarantees trustworthy findings

Distinct verdicts – confirmed includes a complete source trace and bounded observed result; needs_validation records an exact unresolved fact with no severity; rejected marks a disproved candidate.
Adversarial validation – The agent that discovers a finding never validates it, eliminating self‑confirmation bias.
Additive runs – Subsequent audits reuse prior ledgers and findings, targeting only uncovered gaps and re‑validating changed code without treating stale work as covered.
Independent verification – After Phase 4, a fresh agent re‑checks every claim; replacements trigger another verification round, ensuring no single agent can unilaterally declare a vulnerability.

Installation and usage in minutes

# Install the skill globally (or per‑project) via the Skills CLI
npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit \
  --global   # optional, for a user‑level install

Run the audit from any directory containing the target codebase:

security audit this codebase
# or
find security vulnerabilities in ./src
# or
do a security review, output to ~/audits/my-project

The skill auto‑detects trigger phrases (e.g., "security audit", "find vulnerabilities") and launches the full six‑phase workflow. In full‑audit mode, output defaults to ~/security-audit-skill/<repo-name>/run-<N> unless an explicit directory is supplied.

Required environment for safe execution

Coding agent – Must support tool use and parallel sub‑agents.
Node.js – Needed for the zero‑dependency validators.
OS‑enforced sandbox – Isolates builds, tests, browsers, fuzzers, etc., disables external networking, enforces resource limits, and restricts writes to designated scratch paths. Without sandboxing, the skill marks the lead as needs_validation instead of executing target code.

Design principles that shape the audit

Confirm only established boundary failures – Unresolved facts stay in needs_validation.
Severity requires impact – Likelihood multiplied by real‑world impact, not checklist deviation.
Defense‑in‑depth gaps are hardening notes – Missing layers are not automatically classified as vulnerabilities.
Repeated runs improve coverage – Cloudflare’s internal tests showed a single run finds roughly half of the total vulnerabilities discovered across multiple runs.

Community reactions on Hacker News

"Shameless plug: in case someone finds this requiring too many tokens, we shared the recipe on how we built our own in‑house audit skill so that it can easily be replicated and tuned to different environments" – gbrindisi

"I threw 1M tokens for nothing in a medium codebase." – drchaim

"Tip for security professionals using LLMs: audit skills that explicitly frame the task as security research sometimes trigger refusals from the top OpenAI and Anthropic models because they guard against misuse. What works for me: separate skills for bug classes (and bugs in general) without the security framing, plus another skill that combines their findings to spot security bugs." – wslh

"Dumping 14 full schemas into the prompt is just lazy design. You burn tokens, spike latency for no reason" – qsbuilder

These comments highlight practical concerns: token cost, model refusal handling, and the trade‑off between rich schema definitions and prompt efficiency.

When to use (and when not to use) the skill

Ideal – Large codebases where reproducible, auditable findings are required, and where a sandboxed execution environment can be provisioned.
Less ideal – Small projects where token cost outweighs the benefit, or environments where LLM providers block security‑framed prompts.

Where to get help or contribute

For questions, feedback, or collaboration on AI‑driven security tooling, email security‑ai‑research@cloudflare.com. The repository is MIT‑licensed, allowing unrestricted modification and redistribution.