Cloudflare Releases Security Audit Skill for Coding Agents

X postEmre SavcıTool

Cloudflare has open-sourced security-audit-skill, a coding-agent skill designed to run multi-phase, automated security audits on codebases. It coordinates isolated agent roles across reconnaissance, vulnerability hunting, and independent verification.

Key points

  1. Six-phase audit pipeline: Reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.
  2. Separation of concerns: Newly spawned verifier agents explicitly try to disprove candidate vulnerabilities found by hunters to prevent false positives.
  3. Strict verdict schema: Audit records are classified into 'confirmed' (complete source trace), 'needs_validation' (unresolved facts), and 'rejected'.
  4. Comprehensive attack classes: Includes dedicated rule sets for AI/LLM vulnerabilities, web authentication, supply chain, cloud deployments, memory safety, and client-side flaws.
  5. Installable via the Skills CLI using npx skills add directly from GitHub.

Why it matters

Ad-hoc LLM code audits often suffer from hallucinations and confirmation bias. By enforcing a multi-stage protocol where finding and verifying are performed by separate agents, teams obtain reproducible, machine-readable vulnerability reports with verified code traces.

Analysis

Originating as the seed for Cloudflare's internal fleet-wide vulnerability harness, this repository provides a reproducible audit framework for local agent runs. The architecture pairs agentic exploration with deterministic verification: zero-dependency JavaScript validators check the coverage ledger and findings against strict JSON schemas, while multiple audit runs on the same repository build additively upon previous findings.

Original post

Emre Savcı

@mstrYoda_ · 14 September 2026

CloudFlare AI Agentlar için security-skill yayınlamış, direkt yapıştıralım 👇 t.co/NMN5oH2ijv

1.6k likes7 replies2.8k bookmarks143.6k views

View on X
More posts in the thread (2)
  1. @GustavHartz As always, tech stack may change but the rules are same.
  2. @oguzhndev Yabancı time’a düştü galiba beğenenlerde de çok var
Selected replies (5)
  • @GustavHartz @mstrYoda_ Always review the skill before running it in an agent locally. It's basically as just running some code you found on the internet
  • @AnandNSharma @mstrYoda_ A tool that flags security issues in AI generated code still needs a second set of eyes on what it flags. Skipping that step just moves the trust problem from the code to the audit itself.
  • @mercury__agent @mstrYoda_ Great. It will be built-in mercury agent by default.
  • @oguzhndev @mstrYoda_ Yorumlar full ingiliççe
  • @yigitksp1914 @AnandNSharma @mstrYoda_ This is exactly why it was designed for and the same reason phase 3 and 6 exist. Agent who finds and verifies are not the same one. It doesn't move it literally solves it.

Mentioned links

Links and tools from this entry

Summary generated by AI (Gemini 3.8 Flash, 27 September 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • X post:0xMarioNawfal

    Cloudflare Open-Sources Coding-Agent Skill for Structured Security Audits

    Cloudflare has open-sourced an audit skill for coding agents that conducts multi-phase code security reviews with independent candidate verification. The project represents the standalone foundation of Cloudflare's internal vulnerability discovery harness.

    749bookmarks86.4kviews

    AI & LLMs· Tool

  • X post:Brais Moure

    Cloudflare Releases Open-Source Security Audit Skill for Coding Agents

    Brais Moure highlights the release of Cloudflare's 'security-audit-skill'. The tool turns coding agents into multi-phase security auditors and served as the foundation for Cloudflare's internal vulnerability discovery harness.

    3.4kbookmarks139.4kviews

    AI & LLMs· Tool

  • Repository:cloudflare/security-audit-skill

    Cloudflare Open-Sources Security Audit Skill for Coding Agents

    Cloudflare's security-audit-skill is an open-source coding-agent workflow that orchestrates multi-phase security audits with independently verified, machine-readable findings.

    5.2kstarsJavaScript

    AI & LLMs· Tool

  • Repository:NVIDIA/SkillSpector

    SkillSpector: Security Scanner for AI Agent Skills by NVIDIA

    SkillSpector is an open-source security scanner from NVIDIA designed to inspect extensions and skills for AI agents (such as Claude Code, Codex CLI, and MCP) for vulnerabilities and malicious patterns before installation.

    15.9kstarsPython

    AI & LLMs· Tool

  • Repository:affaan-m/agentshield

    AgentShield: Security Auditor for Claude Code and MCP Configurations

    AgentShield is an open-source TypeScript security scanner designed for AI agent setups. It inspects `.claude/` directories to detect hardcoded secrets, unverified MCP servers, hook injection vulnerabilities, and tool permission misconfigurations.

    1.2kstarsTypeScript

    AI & LLMs· Tool

  • Link:SkillPatch

    SkillPatch: Directory for Security-Verified AI Agent Skills

    SkillPatch is a public registry for AI agent skills based on the open SKILL.md standard. The platform provides automated security assessments prior to publication and supports tools such as Claude Code, Cursor, and GitHub Copilot.

    AI & LLMs· Tool

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.