Security Audit Skill

security-audit-skill is a coding-agent skill from Cloudflare that turns a coding agent into a structured security auditor. It's built for developers and security engineers who want an AI agent to hunt for vulnerabilities in a codebase using isolated sub-agents, coverage tracking, and adversarial verification instead of a single pass of unchecked guesses. It's the single-repo seed for the harness described in Cloudflare's "Build your own vulnerability harness" post.

The skill runs a fixed six-phase workflow: reconnaissance (mapping architecture and trust boundaries into architecture.md and coverage-ledger.json), coverage-led hunting by isolated hunter agents, candidate validation by fresh verifiers trying to disprove each finding, structured output written to findings.json against a JSON schema, independent record verification by separate agents, and target-neutral reporting into REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md. Zero-dependency Node.js validators (validate-findings.cjs, validate-coverage-ledger.cjs) check the ledger and findings files at each relevant phase.

Key features

• Multi-phase workflow: reconnaissance, hunting, validation, structured output, record verification, and reporting run as distinct phases with defined handoffs.
• Adversarial verification: the agent that finds a candidate is never the one that verifies it, and material replacements get another independent verifier.
• Distinct verdict types: confirmed, needs_validation, and rejected records each carry different evidentiary requirements (source trace, unresolved fact, or disproof).
• Coverage ledger: coverage-ledger.json tracks what's been checked, so repeated runs target gaps instead of re-covering old ground.
• Attack-class library: separate reference files cover memory safety, LLM/prompt-injection, web protocol and auth, client-side, supply chain, cloud/deployment, RPC/messaging, resource exhaustion, data isolation, and desktop/mobile/IPC classes.
• Schema-validated findings: findings.json is checked against report-schema.json with a zero-dependency validator, both after generation and after any Phase 5 replacement.
• Additive runs: multiple audits against the same repo reuse prior ledgers and findings instead of starting from zero.

Ideal use cases

This fits teams that already run a coding agent (with tool use and parallel sub-agent support) and want a repeatable, semi-structured way to have it audit a codebase for vulnerabilities, producing machine-readable output alongside a human-readable report. It's useful for periodic security reviews of internal services, pre-release audits, or building a custom fleet-wide harness on top of the same phase structure Cloudflare used internally.

It is not a drop-in replacement for a dedicated static analysis tool or a professional pentest, and it explicitly refuses to "confirm" anything it can't ground in source and a bounded observed result: ambiguous leads stay needs_validation rather than getting inflated into findings. It also assumes you can provide an OS-enforced sandbox for any target-controlled code execution (builds, tests, fuzzers, browsers); without that, the workflow deliberately avoids running target code and leaves matching leads unresolved. If you need a one-shot answer with no sandboxing and no willingness to leave things unresolved, this isn't the right tool.

Installation

Install the skill using the Skills CLI:

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit

For a user-level (global) installation:

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit \
  --global

Run npx skills --help for agent-selection and non-interactive install options.

Once installed, start your coding agent in (or pointed at) the target codebase and ask for an audit, for example:

security audit this codebase

find security vulnerabilities in ./src

do a security review, output to ~/audits/my-project

The skill triggers automatically on audit/pen-test phrasing. Full audit mode writes output to ~/security-audit-skill/<repo-name>/run-<N> by default unless you point it at a version-control-ignored directory inside the target repo. You'll need Node.js locally for the validators and a coding agent whose model supports tool use and parallel sub-agents.