cloudflare/security-audit-skill

What it solves

It transforms a coding agent into a professional security auditor capable of systematically discovering vulnerabilities in a codebase. It replaces ad-hoc security checks with a structured, multi-phase process that ensures comprehensive coverage and rigorous verification of findings.

How it works

The skill orchestrates a six-phase workflow using isolated agents:

1. Reconnaissance: Maps the architecture, trust boundaries, and input surfaces to create a coverage ledger.
2. Coverage-led hunting: Assigns hunters to specific ledger units to find gaps and potential bugs.
3. Candidate validation: Uses fresh verifiers to attempt to disprove every unique candidate finding.
4. Structured output: Records results as confirmed, needs validation, or rejected based on a JSON schema.
5. Independent record verification: Employs separate agents to verify final source claims.
6. Target-neutral reporting: Generates final reports and detailed findings documents.

Who it’s for

Developers and security researchers who use AI coding agents and want to perform deep, systematic security audits of their software projects.

Highlights

• Adversarial Validation: Ensures the agent verifying a finding is never the one that discovered it.
• Coverage Tracking: Uses a coverage ledger to identify gaps and allow additive runs to improve discovery rates.
• Broad Attack Classes: Includes specialized hunting prompts for memory safety, LLM-specific vulnerabilities, web protocols, supply chain, and cloud deployment.
• Strict Verdicts: Distinguishes between confirmed vulnerabilities (with source traces) and leads that still need validation.