CloudflareSecurityAuditSkill
title: cloudflare/security-audit-skill type: tool created: 2026-09-20 last_updated: 2026-09-20 related: ["Agent-Orchestrated Codebase Audit", "Self-Hosted Application Security Review"] sources: ["https://github.com/cloudflare/security-audit-skill"] radar_quadrant: Tools radar_ring: Assess radar_position: inner
A single AI pass over a codebase tends to produce security findings that nobody has checked, so reviewers waste time on false alarms. cloudflare/security-audit-skill is an installable coding-agent skill that runs a structured audit in which the agent that finds a problem is never the agent that confirms it.
The skill maps the architecture and trust boundaries, assigns isolated agents to hunt through coverage units, gives each candidate to a fresh agent that tries to disprove it, writes structured results, has further independent agents verify the source claims, and finally derives human-readable reports. Its own README says it seeded Cloudflare's internal vulnerability discovery harness.
Every finding is recorded as confirmed, needs_validation or rejected, and small validator scripts check the result files against a JSON schema. Repeat runs are additive, and the README reports that in its test runs a single run found roughly half of what repeated runs found in total.
It needs a coding agent that supports tool use and parallel sub-agents, Node.js for the validators, and an OS-enforced sandbox before any target code is run. Without a sandbox, the skill leaves such leads as needs_validation instead of executing them.
The skill is placed in Assess. The repository is MIT-licensed, had about 17,400 stars and 44 open issues when checked, and comes from a well-known security vendor, but that is external evidence and not first-person use. It is worth exploring as a reference design for verified, machine-readable AI security review.
