Cloudflare's Security-Audit Skill: Free AI Security Audits

Your coding agent can now write a feature, refactor a module, and wire up an API before your coffee cools. The awkward question is who checks the security of what it just wrote. Ask most agents for a security review and you get a confident paragraph that misses the interesting bugs. Cloudflare's answer is to stop asking nicely and start running a process: the company open-sourced security-audit, the coding-agent skill that seeded its own vulnerability discovery harness, and developers have responded by starring it more than 57,000 times. Installed with a single command, it turns the agent you already use into a structured, six-phase security auditor. It is free, MIT-licensed, and model-agnostic. It also comes with two honest costs: your agent's token bill, and a sandbox you actually have to build.

What "security-audit" actually is

A skill, in the current agent-tooling sense, is a set of reusable instructions that teaches a coding agent how to do one job well. Cloudflare's security-audit skill is a package of markdown instruction files plus two small JavaScript validators. There is no scanner to download, no dashboard, no model to rent. You install it into the agent you already run, point that agent at a codebase, and the skill orchestrates the audit.

Cloudflare's README describes it as "a coding-agent skill that turns your agent into a security auditor," running isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. It is the same "skill" mechanism behind other recent agent add-ons like the Impeccable design skill, except this one hunts vulnerabilities instead of ugly UI.

Two properties matter for trust. First, the license is MIT, so commercial use and modification are fine, and nothing in the skill touches Cloudflare's services: no Cloudflare account, no API key beyond whatever your agent already uses. Second, the provenance is checkable. The README calls it the skill that seeded Cloudflare's vulnerability discovery harness, the internal system described in the company's June 2026 engineering blog. This is not a marketing artifact built for an announcement and abandoned after it; it is the documented starting point of something a large infrastructure company still runs against its own code.

Why 57,000 developers starred it this month

The repository was created on June 18, 2026, and climbed quietly through the summer. Then October happened: roughly 33,000 stars around October 20, 47,500 by October 30, about 54,700 on October 31, and 57,314 stars with 3,725 forks on a live GitHub API check for this article. That is on the order of 24,000 stars in under two weeks, including more than 12,800 in a single week, enough to top GitHub's daily Trending page at over 2,700 stars a day.

The timing is not mysterious. Coding agents moved into production codebases this year, and every team shipping agent-written code faces the same question: who audits it? A deterministic scanner finds known patterns; a generic agent review finds whatever the model happens to notice. A structured, adversarial audit process promises something in between, and it arrives as a one-line install instead of a procurement cycle.

The six phases, in plain English

The published skill runs the audit in six phases. (Cloudflare's June blog post describes the original as a seven-phase workflow; the skill was reworked in September, and the README now documents six.)

1. Reconnaissance. Parallel research agents map the architecture, trust boundaries, and input surfaces into architecture.md and a machine-readable coverage-ledger.json. The ledger is the audit's memory, and a validator script checks it after every update.

2. Coverage-led hunting. Isolated hunter agents take assignments from ledger units and try to break the code rather than review it, while coverage critics hunt for gaps. The hunting classes ship as instruction files covering memory safety and binaries, AI-and-LLM issues like prompt injection, web protocols and authentication, client-side attacks, supply chain and release pipelines, cloud and deployment configuration, RPC and messaging, resource exhaustion, data isolation and lifecycle, and desktop, mobile, and local IPC.

3. Candidate validation. Every unique candidate goes to a fresh verifier whose job is to disprove it. This is the step most casual agent reviews skip.

4. Structured output. Survivors are written to findings.json with one of three verdicts, confirmed, needs_validation, or rejected, and checked against a JSON schema by a zero-dependency script. Node.js is required to run the validators.

5. Independent record verification. Fresh agents re-verify the final source claims, so the evidence is checked by something other than the process that produced it.

6. Target-neutral reporting. The verified records become three human-readable files: REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md. Reports land outside your repository by default, in ~/security-audit-skill/<repo-name>/run-<N>.

The design ideas worth stealing

The phases are competent; the principles are the interesting part. Cloudflare states them directly, and they read like lessons from running the thing at scale:

• Adversarial validation. The agent that checks a finding is never the agent that found it.
• Severity requires impact. Likelihood times impact, not deviation from a checklist.
• Only confirm established boundary failures. An unresolved lead stays needs_validation with its exact unresolved fact recorded, and gets no severity. Guesses are not findings.
• Defense-in-depth gaps are hardening notes, not vulnerabilities. If layer A already prevents the attack, the missing layer B is a note, not a bug.
• Machine-readable output. Findings are emitted as findings.json against a schema, so the audit feeds pipelines, not just a human reader.
• Run it more than once. Cloudflare's own test runs found that a single run caught roughly half the vulnerabilities that repeated runs found in total. Runs are additive: the skill reuses prior ledgers to target gaps and revalidate changed code.

Where Cloudflare took the idea

The origin story is in Cloudflare's June 2026 post "Build your own vulnerability harness." The team started with a roughly 450-line version of this skill on a single repository and tuned the prompts until it surfaced real bugs. Six weeks later it had grown into a fleet-wide harness scanning 128 repositories, with cross-repo dependency tracing and a two-stage pipeline where one model discovers and a different model validates.

The company has published lifetime numbers for the internal system: about 20,799 raw candidates from discovery, roughly 12,057 surviving validation, and 13,841 findings in a shared triage pool across 145 repositories. Those are Cloudflare's own figures, reported via third-party coverage and not independently verified. Treat them as the company's account of its experience, which is still more evidence than most open-source security tools ship with.

Cloudflare is equally direct about the skill's limits. Its blog lists three walls: context exhaustion (an hour in, the model starts cannibalizing its own memory), persistence (a crash mid-run means starting over), and cross-repo blindness. The advice is practical: start with the skill, get the prompts working, and build the next stage only when its absence slows you down. Note that the full fleet harness is not public; what you install is the single-repo starting point it evolved from.

Installing it: the actual steps

1. Check the requirements. You need a coding agent whose model supports tool use and parallel sub-agents. Claude Code, Codex, Cursor, and OpenCode are the named examples, and the Skills CLI documentation lists 75 more. You also need Node.js and the sandbox below.
2. Install the skill. Run the command from Cloudflare's README, which uses Vercel Labs' open-source Skills CLI:
   npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit
   Add --global for a user-level install.
3. Point your agent at the target codebase, then ask for the audit. "Security audit this codebase" or "find security vulnerabilities in ./src" triggers full audit mode; the skill also activates on phrases like "pen-test the code."
4. Read the output under ~/security-audit-skill/<repo-name>/run-<N>: REPORT.md for the summary, FINDINGS-DETAIL.md for evidence, NEEDS-VALIDATION.md for the unproven leads.

The sandbox requirement: the part most people will skip

This section decides whether the audit is worth anything. The README requires an OS-enforced sandbox for anything that builds, tests, or executes the target: external networking disabled, a sanitized allowlisted environment, resource limits enforced, the target mounted read-only, writes restricted to scratch paths.

Without those controls, the workflow refuses to execute target code and keeps leads as needs_validation. The audit still runs, but nothing gets proven by execution, and findings stay in the "interesting but unproven" bucket. Cloudflare's own experience: the biggest jump in finding quality came from giving hunter agents a sandbox to crash binaries in. Building it is real work, but it is the difference between an audit and a reading exercise. Plan for it before your first run, not after your third disappointing report.

What it actually costs

The skill costs nothing: MIT license, no paid tier, no Cloudflare account. The audit costs whatever your agent charges for tokens. A sense of scale from third-party reporting on Cloudflare's setup: a roughly 30,000-line repository takes three to four hours of agent time. Budget an audit like a long, multi-agent coding session, not a single prompt. On a subscription plan that is a real chunk of your usage allowance; on pay-per-token billing it is real money.

One more line item, from third-party testing of the installer: Vercel's Skills CLI collects anonymous usage data, which you can switch off with DO_NOT_TRACK=1. Small thing, but it belongs in a security article.

What it cannot do

A single run finds roughly half of what repeated runs find, and findings skew toward the simpler bugs. It needs a capable model; a weak model with the same instructions produces a weak audit. It is not a substitute for a human security review or a professional penetration test. Its output is candidates with evidence, and candidates are the start of triage, not the end of it.

And a boundary worth stating plainly: only audit code you own or have explicit permission to review. Pointing an automated vulnerability hunter at someone else's system is a legal problem, not a feature. This is defensive tooling; it exists so you find your own bugs first. For the alert-triage side of AI security, the open-source AiSOC project covers the SOC workflow this skill does not touch.

Pro tips

• Run it at least twice and diff the findings. The README's own data says one run catches about half; the second run is not optional.
• Use different models for discovery and validation. Cloudflare's harness deliberately cross-tests models, and the skill inherits the logic: a finding that survives two models' scrutiny is worth more.
• Calibrate on a small repo first that you know well, so you can judge signal versus noise before trusting it on unfamiliar code.
• Read NEEDS-VALIDATION.md, not just REPORT.md. The unproven leads are where the interesting unknowns live, and where a missing sandbox shows up as a pattern.
• Keep the skill updated. The workflow was reworked in September 2026; check the repository for changes before each audit.

How it compares

The honest pairing is the skill plus a deterministic scanner: one reasons about logic the rules have never seen, the other catches the known patterns cheaply on every commit.

FAQ

Is Cloudflare's security-audit skill really free?

Yes. It is MIT-licensed with no paid tier, and it needs no Cloudflare account and no API key beyond what your coding agent already uses. The real cost is the tokens your agent burns running the audit, which for a mid-size repo means a multi-hour session.

Which coding agents does it work with?

Any agent whose model supports tool use and parallel sub-agents. The Skills CLI documentation names Claude Code, Codex, Cursor, and OpenCode, plus 75 more. If your agent cannot run parallel sub-agents, the multi-phase workflow cannot run as designed.

Do I need a Cloudflare account or API key?

No. The skill is a set of markdown instructions plus two JavaScript validators that run on your machine. Nothing in the audit calls Cloudflare's services.

How long does a security audit take?

It depends on repository size and model speed. Third-party reporting on Cloudflare's setup puts a roughly 30,000-line repository at three to four hours of agent time. Treat it as a background job, budget tokens accordingly, and run it more than once.

Can it replace a human security review?

No. Cloudflare's own test runs found that a single run catches roughly half of what repeated runs catch, and the findings skew toward simpler bugs. Treat the skill as a tireless first pass that produces evidence-backed candidates; the sign-off still belongs to a qualified human.

Is it safe to run against my code?

The skill is read-first and designed around sandboxing, but two conditions apply: only audit code you own or have permission to review, and set up the OS-enforced sandbox the README requires. Without the sandbox, the workflow will not execute target code and its findings stay unverified.

Sources

• cloudflare/security-audit-skill: official GitHub repository and README (six phases, install command, requirements, design principles, MIT license; star and fork counts verified live via the GitHub API, November 2, 2026)
• Cloudflare Blog: "Build your own vulnerability harness" (June 2026): origin of the skill, the six-week path to a 128-repo fleet harness, single-run coverage limits, context-exhaustion and persistence walls
• vercel-labs/skills: Skills CLI README (installation tool; supports Claude Code, Codex, Cursor, OpenCode, and 75 more agents)
• MarkTechPost: "AI Security Agents Compared" (October 30, 2026): star counts, Cloudflare-reported lifetime finding numbers, comparison framing
• Pivot News (October 6, 2026): six-phase workflow detail and the verifier-never-finder rule
• Anycreo (October 31, 2026): install walkthrough, agent support, Skills CLI telemetry note
• Zentor (October 2026): September 2026 workflow rework, provenance analysis
• Fireup (October 2026): star trajectory, fleet-harness status
• AI Frontier (October 16, 2026): phase summary, validator details, audit-time scale reference
• Deduped: Hot AI repos: weekly star velocity data
• Toolclove (October 2026): GitHub daily Trending placement
• skills.sh: agent skills directory (installer ecosystem context)

This article is general information, not legal or professional security advice. Audit output is a starting point for qualified human review, and you should only audit code you own or have permission to review.