Cloudflare Releases Open-Source Security Audit Skill for Coding Agents

X postBrais MoureTool

Brais Moure highlights the release of Cloudflare's 'security-audit-skill'. The tool turns coding agents into multi-phase security auditors and served as the foundation for Cloudflare's internal vulnerability discovery harness.

Key points

  1. Cloudflare has open-sourced 'security-audit-skill', an agent skill designed for systematic, multi-phase security audits of codebases.
  2. The audit workflow runs across six phases: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.
  3. Findings are written to machine-readable JSON records with strict verdicts: confirmed, needs_validation, or rejected.
  4. Repeated runs on the same repository are additive, using coverage ledgers to avoid duplicate work and focus on unexamined code or recent changes.
  5. The skill is distributed for coding agents and installable via the Skills CLI using npx.

Why it matters

AI-assisted code reviews frequently generate high volumes of false positives. Cloudflare's structured methodology decouples vulnerability hunting from adversarial verification, forcing independent agent instances to disprove candidate issues before reporting them.

Analysis

By open-sourcing the starting point of its internal vulnerability harness, Cloudflare provides an operational template for agentic software security. Rather than expecting a single model pass to spot vulnerabilities, the skill introduces architectural mapping, ledger-based test tracking, and schema validation. This multi-agent verification pipeline demonstrates how LLM-based development tools can deliver reliable, auditable outputs in sensitive domains.

Original post

Brais Moure

@MoureDev · 18 September 2026

Cloudflare ha lanzado su propia skill completísima de auditorías de seguridad. Es la que utilizaban internamente en la empresa como sistema de detección de vulnerabilidades. → t.co/p2WjZT7phe t.co/tBTnodwdtc

2.3k likes17 replies3.4k bookmarks139.4k views

View on X
Selected replies (5)
  • @b45t3rr @MoureDev cloudflare lover detectado. esto me llega al alma, lo pruebo al toque en mis flujos de noche
  • @JeffScottDev @MoureDev @grok is this true? Has anyone from CF acknowledged it?
  • @buildAgoat @JeffScottDev @MoureDev @grok I mean its on their github
  • @skatox @MoureDev Acabo de probarlo, arroja muy buenos resultados, aunque consumió bastantes tokens usando Fable 5.1 con esfuerzo "alto"
  • @grok @JeffScottDev @MoureDev Yes, it's true. Cloudflare published the official repo under their GitHub org and confirmed in their June 18, 2026 blog post ("Build your own vulnerability harness") that this skill seeded their internal vulnerability discovery system used for detecting real bugs. They also

Mentioned links

Links and tools from this entry

Summary generated by AI (Gemini 3.8 Flash, 27 September 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • X post:Emre Savcı

    Cloudflare Releases Security Audit Skill for Coding Agents

    Cloudflare has open-sourced security-audit-skill, a coding-agent skill designed to run multi-phase, automated security audits on codebases. It coordinates isolated agent roles across reconnaissance, vulnerability hunting, and independent verification.

    2.8kbookmarks143.6kviews

    AI & LLMs· Tool

  • X post:0xMarioNawfal

    Cloudflare Open-Sources Coding-Agent Skill for Structured Security Audits

    Cloudflare has open-sourced an audit skill for coding agents that conducts multi-phase code security reviews with independent candidate verification. The project represents the standalone foundation of Cloudflare's internal vulnerability discovery harness.

    749bookmarks86.4kviews

    AI & LLMs· Tool

  • Repository:cloudflare/security-audit-skill

    Cloudflare Open-Sources Security Audit Skill for Coding Agents

    Cloudflare's security-audit-skill is an open-source coding-agent workflow that orchestrates multi-phase security audits with independently verified, machine-readable findings.

    5.2kstarsJavaScript

    AI & LLMs· Tool

  • Repository:NVIDIA/SkillSpector

    SkillSpector: Security Scanner for AI Agent Skills by NVIDIA

    SkillSpector is an open-source security scanner from NVIDIA designed to inspect extensions and skills for AI agents (such as Claude Code, Codex CLI, and MCP) for vulnerabilities and malicious patterns before installation.

    15.9kstarsPython

    AI & LLMs· Tool

  • Repository:affaan-m/agentshield

    AgentShield: Security Auditor for Claude Code and MCP Configurations

    AgentShield is an open-source TypeScript security scanner designed for AI agent setups. It inspects `.claude/` directories to detect hardcoded secrets, unverified MCP servers, hook injection vulnerabilities, and tool permission misconfigurations.

    1.2kstarsTypeScript

    AI & LLMs· Tool

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.