cloudflare/security-audit-skill

A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings

What it solves

This project provides a structured framework for AI coding agents to perform comprehensive security audits of codebases. It moves beyond simple pattern matching to find exploitable vulnerabilities with real impact by using an adversarial, multi-agent orchestration pipeline.

How it works

The skill transforms a coding agent into a security auditor through a six-phase pipeline:

  1. Reconnaissance: Parallel agents map the application's architecture and trust boundaries.
  2. Hunting: Specialized agents attack the codebase from various angles (e.g., injection, access control, business logic) and can spawn sub-agents for deeper investigation.
  3. Validation: Independent agents attempt to disprove findings to eliminate false positives.
  4. Reporting: Generates human-readable reports and detailed traces for significant findings.
  5. Structured Output: Produces a validated JSON file of findings.
  6. Independent Verification: Fresh agents verify every factual claim against the source code.

Who it’s for

Developers and security researchers who use AI coding agents that support tool use and parallel sub-agents, and who want to automate the discovery of exploitable security vulnerabilities in their software.

Highlights

  • Adversarial Validation: Ensures the agent that validates a finding is never the same one that ever found it.
  • Exploit-focused: Requires concrete attack scenarios rather than theoretical risks.
  • Additive Coverage: Multiple runs are designed to be additive, reading prior findings to target gaps and explore new code paths.
  • Broad Attack Classes: Includes specialized prompts for memory safety, LLM-specific vulnerabilities (prompt injection), and web protocols.

Related

  • Project
    Kritt-ai/open-kritt

    An open-source security research platform that orchestrates AI agents to find, validate, and rank vulnerabilities in codebases using focused, parallelized workflows.

  • Project
    larlarua/AutoCVE

    An automated vulnerability discovery system that uses a multi-agent AI framework to screen projects, audit source code, and generate CVE reports.

  • Project
    lintsinghua/DeepAudit

    DeepAudit is an open‑source, multi‑agent AI security auditor that analyses code, generates and sandbox‑executes PoC exploits, and outputs professional reports. It runs via Docker, supports local LLMs, and aims to reduce false positives and verify vulnerabilities automatically.

  • Project
    google/mantis

    A portable toolkit of skills for coding agents to enable automated, sequential security reviews, vulnerability discovery, and patching of software and hardware codebases.

  • Project
    XiNian-dada/Fuck_My_Shit_Mountain

    A codebase auditing skill for AI coding agents that provides structured, evidence-based reports across 25 dimensions including security, stability, and AI safety.