Cloudflare Security Audit Skill

Find real vulnerabilities in your codebase before launch, without a pile of false positives

Find the vulnerabilities in your code before attackers do. Ask your agent to "security audit this codebase" and it maps the architecture, sends isolated sub-agents to hunt for bugs, has fresh agents try to disprove every candidate, and writes a report with only the findings that survived.

The rule that makes it different from a plain "review this for security" prompt: the agent that checks a finding is never the one that found it. That cuts the false positives that make most AI security reviews tiring to read. It's the same audit Cloudflare runs on its own code, free and MIT. Works with any agent that supports tool use and parallel sub-agents, like Claude Code, Codex and Cursor.

How it works

Phase	What happens
Reconnaissance	Maps architecture, trust boundaries and input surfaces into `architecture.md` and a coverage ledger
Hunting	Isolated hunters take units from the ledger; coverage critics look for what they missed
Validation	A fresh verifier tries to disprove each unique candidate
Structured output	Findings go to `findings.json` as `confirmed`, `needs_validation` or `rejected`
Record verification	New agents re-check the source claims in the final records
Report	`REPORT.md`, `FINDINGS-DETAIL.md` and `NEEDS-VALIDATION.md`

Hunters follow attack-class guides for web and auth protocols, AI/LLM apps, supply chain, cloud, client-side, RPC and messaging, data isolation, resource exhaustion, memory safety and desktop/mobile IPC. Severity is judged by likelihood and impact, not by checklist deviation, and defense-in-depth gaps are reported as hardening notes, not vulnerabilities.

How to start

Install it with skills.sh: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit. Add --global to install it for all projects.

Open your agent in the repo and ask: "security audit this codebase", "find security vulnerabilities in ./src" or "do a security review, output to ~/audits/my-project".

Read REPORT.md first, then NEEDS-VALIDATION.md for leads the agent couldn't prove on its own.

Run it again. Cloudflare found that a single run catches about half of what repeated runs find in total.

A plain security question runs in a lighter guidance mode. Reports go to ~/security-audit-skill//run- unless you pick a folder, so they don't end up in your git history.

⚠️

To prove a finding by running the target's code (builds, tests, exploits), the skill needs an OS-level sandbox with no network access. Without one, it doesn't run target code and leaves those leads as needs_validation.

Alternatives

vibe-security: a lighter skill for vibe-coded apps that checks exposed keys, Supabase RLS, Firebase rules and payment flows, and writes an HTML report with a fix for each finding.

Claude Code /security-review: built-in command that reviews the current changes, good for every PR.

Snyk, Semgrep, CodeQL: rule-based scanners for CI. Faster and cheaper per run, but they miss logic and auth bugs an agent can reason about.

More background in Cloudflare's post: Build your own vulnerability harness.

Ship faster than your competition

Focus on customers and sales while we handle product delivery. Hire a dedicated AI maker or a whole product team.

Launch new products

Fix your delivery

Hit fundraising milestones

View recent work