security-audit-skill is a Cloudflare skill that turns a coding agent into a security auditor, running a six-phase audit with adversarial validation, coverage tracking, and machine-readable verified findings. It addresses unverified, inconsistent findings from security audits performed by coding agents.
Project overview
Its adversarial validation design ensures the agent that checks a finding is never the agent that found it, directly addressing the problem of audits that mix confirmed vulnerabilities with speculation.
Project type
AI Agent · AI Coding
Use cases
Coding & Development · Automation
Deployment
Refer to project documentation
License
MIT
Best for
Developers and AI engineers who already use a coding agent with tool use and parallel sub-agent support and want structured, independently verified security findings
Key capabilities
Orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.
Limitations and risks
Requires a coding agent with tool use and parallel sub-agent support to function; a model meeting these requirements is required.
Usage is via natural-language requests to a coding agent, so no coding is required by the user.
GPU requirements, data boundary, cost dependencies, telemetry, and interaction modes are not documented in the provided facts; verify these before adoption.
Getting started
Install with a single npx skills add command: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit. Then start your coding agent in the codebase and request 'security audit this codebase'.
Evidence and sources
README: A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured…
README: The skill runs a structured audit in six phases: 1. **Reconnaissance** -- map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in `archit…
README: | `AI-AND-LLM.md` | Prompt-injection, agent/tool, and output-handling hunting classes for LLM-backed targets |
README: Install the skill with the [Skills CLI](https://skills.sh):
README: Start your coding agent in (or pointed at) the codebase you want to audit, then ask it to do a security audit