Cloudflare Open-Sources Security Audit Skill for Coding Agents

Repositorycloudflare/security-audit-skillTool

Cloudflare's security-audit-skill is an open-source coding-agent workflow that orchestrates multi-phase security audits with independently verified, machine-readable findings.

Key points

  1. Six-phase audit structure: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.
  2. Separation of concerns: isolated hunter agents detect vulnerabilities, while fresh verifier agents attempt to disprove candidate findings.
  3. Strict data validation: findings are categorized as 'confirmed', 'needs_validation', or 'rejected' and validated against JSON schemas.
  4. Additive and incremental runs: utilizes previous coverage ledgers to inspect delta changes and unaddressed gaps without re-auditing unchanged code.
  5. Specialized attack classes: includes domain-specific guides for memory safety, LLM risks, HTTP/auth protocols, and client-side vulnerabilities.

Why it matters

Standard LLM code inspections frequently produce false positives. Cloudflare's approach solves this by establishing adversarial verification phases and deterministic coverage ledgers directly inside the agent workflow.

Analysis

Originating as the foundation for Cloudflare's internal fleet-wide vulnerability discovery harness, this repository serves development and AppSec teams running automated repository reviews. Implemented using JavaScript validation scripts (such as validate-coverage-ledger.cjs) and structured Markdown prompts, the project demonstrates high maturity with more than 5,000 GitHub stars and clear architectural separation.

Mentioned links

Found in

Summary generated by AI (Gemini 3.8 Flash, 27 September 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • X post:0xMarioNawfal

    Cloudflare Open-Sources Coding-Agent Skill for Structured Security Audits

    Cloudflare has open-sourced an audit skill for coding agents that conducts multi-phase code security reviews with independent candidate verification. The project represents the standalone foundation of Cloudflare's internal vulnerability discovery harness.

    749bookmarks86.4kviews

    AI & LLMs· Tool

  • X post:Emre Savcı

    Cloudflare Releases Security Audit Skill for Coding Agents

    Cloudflare has open-sourced security-audit-skill, a coding-agent skill designed to run multi-phase, automated security audits on codebases. It coordinates isolated agent roles across reconnaissance, vulnerability hunting, and independent verification.

    2.8kbookmarks143.6kviews

    AI & LLMs· Tool

  • X post:Brais Moure

    Cloudflare Releases Open-Source Security Audit Skill for Coding Agents

    Brais Moure highlights the release of Cloudflare's 'security-audit-skill'. The tool turns coding agents into multi-phase security auditors and served as the foundation for Cloudflare's internal vulnerability discovery harness.

    3.4kbookmarks139.4kviews

    AI & LLMs· Tool

  • Repository:NVIDIA/SkillSpector

    SkillSpector: Security Scanner for AI Agent Skills by NVIDIA

    SkillSpector is an open-source security scanner from NVIDIA designed to inspect extensions and skills for AI agents (such as Claude Code, Codex CLI, and MCP) for vulnerabilities and malicious patterns before installation.

    15.9kstarsPython

    AI & LLMs· Tool

  • Link:SkillPatch

    SkillPatch: Directory for Security-Verified AI Agent Skills

    SkillPatch is a public registry for AI agent skills based on the open SKILL.md standard. The platform provides automated security assessments prior to publication and supports tools such as Claude Code, Cursor, and GitHub Copilot.

    AI & LLMs· Tool

  • Repository:affaan-m/agentshield

    AgentShield: Security Auditor for Claude Code and MCP Configurations

    AgentShield is an open-source TypeScript security scanner designed for AI agent setups. It inspects `.claude/` directories to detect hardcoded secrets, unverified MCP servers, hook injection vulnerabilities, and tool permission misconfigurations.

    1.2kstarsTypeScript

    AI & LLMs· Tool

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.