Skip to content
ML2
Coding & Shipping AgentsTool#Plugin / extension#Open source

Cloudflare security-audit skill: agent bug hunts

Added NewCopyable prompt below

Published Last verified Released

Our verdict

The most structured free way to get a security review out of the coding agent you already use. One agent hunts, a separate fresh agent tries to knock each finding down, and validators reject anything without a source trace, so you get fewer false alarms than asking the agent that wrote the code whether it is safe. The cost is tokens: builders on Hacker News reported 150K on a small FastAPI project and up to 1M on a medium codebase, so scope it to a folder or a PR first.

Who it's for
Solo builders and small teams shipping agent-written code who want a security pass before launch without hiring an auditor
Leverage
A repeatable, evidence-checked security audit from one install command and one prompt
Effort
Medium
Date added

What it does

security-audit (cloudflare/security-audit-skill, MIT) is the single-repo skill that seeded Cloudflare's internal vulnerability harness. It runs six phases: reconnaissance maps architecture, trust boundaries and inputs into architecture.md and coverage-ledger.json; isolated hunters work through the ledger while coverage critics look for gaps; every candidate goes to a fresh verifier that tries to disprove it; findings are written to findings.json as confirmed, needs_validation or rejected and checked by bundled zero-dependency Node validators; final claims get another independent check; and REPORT.md is generated from the verified records. Attack-class playbooks cover web and auth, client-side, A.I. and LLM agents, supply chain, cloud, memory safety and more. Repeat runs build on earlier ledgers. It has no analysis engine of its own, results vary between runs, and SKILL.md says target code should only run inside an OS-enforced sandbox with no network; some models stop or refuse on security-framed tasks.

How builders use it

  • Install with npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit (add --global for every project).
  • Open your coding agent in the repo and ask: security audit this codebase, scoped to the folders that handle auth, payments or user input.
  • Read REPORT.md first, then check needs_validation items by hand; they name the exact fact the agent could not confirm.
  • Re-run after fixes; the skill reuses the earlier ledger to target gaps and re-check changed code.

What to expect

A scoped audit with source-traced confirmed findings, open questions listed separately, and rejected candidates recorded instead of reported as bugs.

Copy this: Install + scoped first audit

# Official source: github.com/cloudflare/security-audit-skill (MIT). Needs a skills-capable coding agent and Node.
npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit

# Then, in your coding agent (keep the scope small to control token cost):
security audit this codebase, scope it to <src/auth/, src/api/>, output to <./audit/run-1>

# Check the output with the bundled validator (Claude Code installs skills under .claude/skills):
node .claude/skills/security-audit/validate-findings.cjs ./audit/run-1/findings.json

Related discoveries

See the newest picks →
  • ToolCoding & Shipping Agents

    Sphinx: quiz yourself before shipping agent code

    MIT Git hook that quizzes you on what your coding agent's change does before a protected push continues.

    NewEffort: MediumPrompt#Plugin / extension#Open source

  • ToolCoding & Shipping Agents

    Cursor Bugbot for PR review

    An A.I. reviewer that flags bugs and security issues on every pull request.

    Effort: Low

  • ToolCoding & Shipping Agents

    CodeRabbit

    Independent A.I. code review, PR triage and change explanations.

    Effort: Low

Want more like this?

Practical discoveries, without the noise.

Get the newsletterMore in Coding & Shipping Agents