Cloudflare opens Security Audit Skill — turning a coding agent into an auditor

Cloudflare has released Security Audit Skill to public access — a set of instructions for coding agents that turns them into security auditors. The repository is published under the MIT license, installation takes a single command, and it plugs into any agent that supports tools.

The audit runs in six stages. First the agent does reconnaissance: it maps the architecture, trust boundaries and input surfaces. That map is then used to dispatch isolated "hunters": they look for vulnerabilities and separately record exactly what they have managed to check.

Every candidate finding goes to a fresh verifier who tries to disprove it. The verifier is never the one who found it — the bet is on adversarial validation rather than self-review.

The output is a machine-readable report with three categories: confirmed issues with a full trail back to the source code; findings requiring review, where an exact unresolved question remains without a severity assessment; and rejected candidates. The format is checked by validator scripts, and independent agents re-check the final claims.

The repository honestly states a limitation: a single run finds roughly half the vulnerabilities that repeated runs do. That is why several passes over the same code complement each other and build on the findings already accumulated.

Running it needs an agent that supports parallel subagents, Node.js for the validators, and a strict sandbox: no external network, a stripped-down environment and resource limits. Without such isolation the target code is not executed at all, and the suspicion stays in "requires review" status.

One principle is emphasised separately: severity requires proven impact, and the absence of a second layer of defence is not counted as a vulnerability if the first layer already blocks the attack.

Image:

Translation editors: Соловьев В., Пеков А.