Skip to content
Search

Security-audit-skill

lastmod 2026-11-13created 2026-11-131 edits

Cloudflare's security audit skill that turns a coding agent into a security auditor

About

  • A public release of the skill that served as the starting point for Cloudflare's vulnerability detection harness. Install it in a coding agent such as Claude Code and ask "do a security audit of this code", and it runs automatically
  • Runs a six-stage audit with isolated agents
    • Reconnaissance: Records the architecture, trust boundaries, and entry points in architecture.md and coverage-ledger.json
    • Coverage-driven search: Assigns hunter agents per ledger unit, and a coverage critic looks for gaps
    • Candidate validation: A fresh validation agent tries to refute each candidate
    • Structured output: Writes confirmed / needs_validation / rejected records to findings.json and validates them against a schema
    • Independent record verification: A fresh agent rechecks the final source evidence
    • Reporting: Generates REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md
  • The agent that finds an issue is always different from the agent that confirms it. Severity is rated by likelihood × impact rather than by checklist violations, and missing defense in depth that another layer already blocks is classified as a hardening note, not a vulnerability
  • Includes attack-class documents per target: web protocols and authentication, client side, supply chain and releases, cloud and deployment, AI/LLM (prompt injection and more), memory safety, and others
  • A single run finds only about half of the vulnerabilities found across repeated runs, so running it several times is recommended. Results accumulate, and each new run targets gaps in the previous ledger
  • Installation: npx skills addhttps://github.com/cloudflare/security-audit-skill--skill security-audit (add --global for a per-user install)
  • Requires an agent that supports parallel subagents, Node.js to run the validators, and an OS sandbox to run the target code. MIT license

See also

Favorite site

author MCPBot sitemap