Verified project record

cloudflare/security-audit-skill

security-audit-skill is a Cloudflare skill that turns a coding agent into a security auditor, running a six-phase audit with adversarial validation, coverage tracking, and machine-readable verified findings. It addresses unverified, inconsistent findings from security audits performed by coding agents.

Project overview

Its adversarial validation design ensures the agent that checks a finding is never the agent that found it, directly addressing the problem of audits that mix confirmed vulnerabilities with speculation.

Project type: AI Agent · AI Coding
Use cases: Coding & Development · Automation
Deployment: Refer to project documentation
License: MIT

Best for

Developers and AI engineers who already use a coding agent with tool use and parallel sub-agent support and want structured, independently verified security findings

Key capabilities

Orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.

Limitations and risks

Requires a coding agent with tool use and parallel sub-agent support to function; a model meeting these requirements is required.
Usage is via natural-language requests to a coding agent, so no coding is required by the user.
GPU requirements, data boundary, cost dependencies, telemetry, and interaction modes are not documented in the provided facts; verify these before adoption.

Getting started

Install with a single npx skills add command: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit. Then start your coding agent in the codebase and request 'security audit this codebase'.

Evidence and sources

README: A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured…
README: The skill runs a structured audit in six phases: 1. **Reconnaissance** -- map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in `archit…
README: | `AI-AND-LLM.md` | Prompt-injection, agent/tool, and output-handling hunting classes for LLM-backed targets |
README: Install the skill with the [Skills CLI](https://skills.sh):
README: Start your coding agent in (or pointed at) the codebase you want to audit, then ask it to do a security audit

Source updated at: 2026-09-23T01:30:30Z

Open original GitHub project