cloudflare/security-audit-skill: the agent auditor that argues with itself

cloudflare/security-audit-skill is an MIT-licensed Claude Code skill — a set of Markdown instructions that turns your coding agent into a six-phase security auditor. Install it once, ask your agent for a security audit in plain language, and the skill orchestrates the rest.

What It Does

The workflow runs in stages: map the codebase architecture, assign isolated sub-agents to hunt across multiple attack classes, then send each candidate finding to a completely separate verifier whose only job is to disprove it. The README is direct: "The agent that checks a finding is never the agent that found it." Verdicts come out as confirmed, needs_validation, or rejected — structured JSON, validated by zero-dependency Node.js validators.

Coverage spans memory safety, LLM-backed targets, cloud deployment, supply chain, and desktop/mobile IPC. The skill also supports repeated runs against the same repo — later passes use earlier ledgers to target gaps and recheck changed code.

This is where it came from: Cloudflare built it as their own internal vulnerability discovery harness before open-sourcing it. It currently sits at 51k+ stars.

The Honest Caveats

The sandbox is your problem. To get the most useful results — where the agent actually runs target-controlled builds and tests — you need an OS-enforced sandbox with no external networking, a sanitized environment, resource limits, and writes limited to assigned paths. The skill does not set this up for you. Without one, leads stay as needs_validation and target code never runs.

One run is not enough. In Cloudflare's own testing, a single run found roughly half the vulnerabilities that repeated runs found in total. That's not a knock on the skill — it's an honest expectation-setter baked into the docs. Run it more than once on anything you actually care about.

Installation

npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

# user-level install
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit --global

Requires Node.js and a model with tool use and parallel sub-agent support. After install, just ask your agent to run a security audit — the skill activates on its own.

Credit

Built by Cloudflare, open-sourced under MIT. Full repo at cloudflare/security-audit-skill.