Security Audit Skill (Cloudflare)

cloudflare/security-audit-skill is an agent skill that turns a coding agent into a security auditor, described by Cloudflare as the single-repo starting point of the vulnerability discovery harness behind Build your own vulnerability harness. Everything lives under skills/security-audit/; the repo is one skill, not a toolkit.

Checked 2026-10-27 against the README, SKILL.md, and the GitHub API. I did not install it or run an audit.

The six phases

The parent agent runs validate-coverage-ledger.cjs after creating the ledger and after each update, and validate-findings.cjs in phase 4 and after every phase-5 replacement. Both validators are zero-dependency and ship with tests.

Verdicts are deliberately narrow. confirmed needs a complete source trace and a bounded observed result; needs_validation names one exact unresolved fact and carries no severity; rejected records a disproved candidate. There is no "likely" bucket and no score without an impact.

Modes

• Guidance mode (default when the skill loads): security questions, focused reviews, methodology, triage. It does not run all six phases, create an output directory, or write artifacts.
• Full audit mode: only for an explicit audit/pen-test request, a full or end-to-end review, or when report artifacts are asked for. If the request could be either, the skill asks one question before writing files.
• Output defaults to ~/security-audit-skill/<repo-name>/run-<N>; it writes inside the target repo only when you explicitly choose a directory that version control ignores.
• Runs are additive: prior ledgers and findings target gaps, revalidate changed source, and carry forward current-source evidence without counting stale work as covered.

Hunting classes (reference files)

Orchestration lives in RECONNAISSANCE.md, HUNTING.md, VALIDATION-AND-REPORTING.md and SKILL.md (~22 KB, including setup, terminology, safety rules and audit anti-patterns).

Safety model

Source inspection is read-only. Target-controlled builds, tests, processes, browsers, emulators, fuzzers and fixtures may run only inside an OS-enforced sandbox that provides:

• no external network (loopback namespace only when local client/server traffic is needed),
• an empty environment populated from an allowlist, with scratch-local HOME, temp dirs and caches,
• a read-only target and toolchain, with writes confined to an assigned scratch/,
• explicit CPU, memory, process, file-size, disk and wall-clock limits.

No dependency installation by builds, no probing deployed endpoints or other users' data, no availability tests against live processes, no paid quota. If any control cannot be enforced, the skill does not execute target code and reports the missing capability as a needs_validation blocker with a safe validation plan.

Design principles (from the README)

• Only established boundary failures are confirmed; a source-grounded blocked lead stays needs_validation with its exact unresolved fact.
• Adversarial validation — the agent that checks a finding is never the agent that found it.
• Severity requires impact — likelihood × impact, not deviation from a checklist.
• Defense-in-depth gaps are not vulnerabilities — if layer A stops the attack, a missing layer B is a hardening note.
• Multiple runs improve coverage — in Cloudflare's own test runs, one run found roughly half of what repeated runs found in total.

Install and use

npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit --global

Then start the agent in the target repo and ask, e.g. security audit this codebase, find security vulnerabilities in ./src, or do a security review, output to ~/audits/my-project. The skill also triggers on security questions in guidance mode.

Caveats

• Not a turnkey scanner — the value is the process (ledger, isolation, adversarial verification), and it depends on the host model and on real sub-agent parallelism.
• The sandbox is the bottleneck — without an OS-enforced sandbox the workflow degrades to source reading and needs_validation records rather than reproduction.
• High stars, low maintenance surface — one main contributor, 98 open issues, last push 2026-09-14. The blog post describes a much larger fleet-wide system; this repo is the seed, not that system.
• "Confirmed" still needs human judgement on severity and fix priority; needs_validation is not a finding.
• Not checked: installing the skill, running a full audit, or reproducing any finding.

See also Authorized Artifact Auditor (different, more aggressive skill pack), RedAmon, Security Tools, AI Coding Productivity Tools.