Cloudflare Releases Multi-Phase Security Audit Skill for Coding Agents

X postJuraj BednarTool

Cloudflare has open-sourced 'security-audit-skill', an agent framework that structures security audits through reconnaissance, adversarial validation, and verifiable reporting. Juraj Bednar highlights that using this structured skill enables even low-cost models to outperform unstructured prompts run on premium LLMs.

Key points

  1. Audits follow a six-phase workflow: reconnaissance, coverage-led hunting, candidate validation, structured schema output, independent record verification, and neutral reporting.
  2. Findings are categorised into three distinct statuses: confirmed (verified with source trace and observed result), needs_validation (unresolved fact), and rejected.
  3. Includes standalone validation scripts (validate-coverage-ledger.cjs and validate-findings.cjs); repeated runs on the same repository are additive.
  4. Installed via the Skills CLI using npx skills add.
  5. Bednar reports that Opus 5.5 handled the skill seamlessly, while noting according to his tests that it did not work with GPT models.

Why it matters

Ad-hoc LLM code audits frequently produce false positives and miss attack surfaces. Cloudflare's framework introduces isolated hunter and verifier agents, requiring independent proof to substantiate each reported vulnerability before marking it confirmed.

Analysis

Originating from Cloudflare's internal fleet-wide vulnerability discovery harness, the tool prioritises coverage accounting and falsification. By validating candidate flaws using dedicated agent instances instructed to disprove findings, it substantially reduces hallucinated vulnerabilities and yields machine-readable findings suitable for CI/CD integration.

Original post

Juraj Bednar🏴💛🌘

@jurbed · 21 October 2026

I highly recommend cloudflare's security audit skill: t.co/Mu6Dm0fzk8 Run it on all your software. Run it with the free models. Use it even if you used a model to audit something - it will find much more things. Works in all agent harnesses and is model independent.

8.7k likes132 replies16.4k bookmarks600.1k views

View on X
More posts in the thread (6)
  1. @IamAbhiMishraa Yep
  2. @dupays You can use it with cheap models, even they find things with the skill that the expensive models without it won't find
  3. @catmanyau After it finishes, just write "fix all, commit, push, deploy, thanks"
  4. @Saisharan0099 Simple- you verify. Or rather tell agent to reproduce/verify It hasn't been a problem in practice.
  5. @piyushc_builds Correction: it won't work with gpt models. Opus 5.5 had no problem whatsoever with this skill
  6. @autoinsolvent Use it with cheap models.
Selected replies (5)
  • @piyushc_builds @jurbed Interesting!
  • @Doro_mole @jurbed 艾特一下苏老师谢谢 @Hicker_Moledao @phoebe_mole
  • @ProEvilz @jurbed @piyushc_builds This is false, it does work, I ran it this morning with codex
  • @max_forsey @jurbed @NERDDISCO could be super helpful
  • @ProEvilz @piyushc_builds @jurbed thankfully, not much. Just raised some eyebrows at some logs I have for debugging. imo this skill is not amazing, or my products are bullet proof (most unlikely)... if you want real security audits, run @vercel deepsec

Mentioned links

Links and tools from this entry

Summary generated by AI (Gemini 3.8 Flash, 27 October 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • X post:Emre Savcı

    Cloudflare Releases Security Audit Skill for Coding Agents

    Cloudflare has open-sourced security-audit-skill, a coding-agent skill designed to run multi-phase, automated security audits on codebases. It coordinates isolated agent roles across reconnaissance, vulnerability hunting, and independent verification.

    2.8kbookmarks143.6kviews

    AI & LLMs· Tool

  • X post:0xMarioNawfal

    Cloudflare Open-Sources Coding-Agent Skill for Structured Security Audits

    Cloudflare has open-sourced an audit skill for coding agents that conducts multi-phase code security reviews with independent candidate verification. The project represents the standalone foundation of Cloudflare's internal vulnerability discovery harness.

    749bookmarks86.4kviews

    AI & LLMs· Tool

  • X post:Brais Moure

    Cloudflare Releases Open-Source Security Audit Skill for Coding Agents

    Brais Moure highlights the release of Cloudflare's 'security-audit-skill'. The tool turns coding agents into multi-phase security auditors and served as the foundation for Cloudflare's internal vulnerability discovery harness.

    3.4kbookmarks139.4kviews

    AI & LLMs· Tool

  • Repository:cloudflare/security-audit-skill

    Cloudflare Open-Sources Security Audit Skill for Coding Agents

    Cloudflare's security-audit-skill is an open-source coding-agent workflow that orchestrates multi-phase security audits with independently verified, machine-readable findings.

    5.2kstarsJavaScript

    AI & LLMs· Tool

  • Repository:briiirussell/cybersecurity-skills

    Cybersecurity Skills: Security Workflows for AI Coding Agents

    An open-source repository provides structured cybersecurity skills for AI agents like Claude Code, Cursor, and Codex. It helps developers and security engineers run automated audits, dependency scans, and code reviews directly within agent workflows.

    479starsJavaScript

    AI & LLMs· Tool

  • X post:Corey Haines

    Open-Source Cybersecurity Skills Collection for AI Coding Agents

    Bri Russell has released a major update to her open-source cybersecurity-skills repository. The collection provides security playbooks and automated workflows for AI coding agents like Claude Code, Cursor, and Codex, helping teams without dedicated security personnel run formal audits.

    170bookmarks7.6kviews

    AI & LLMs· Resource

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.