Skip to content
Get packs

security-audit

An agent skill that guides a coding agent through a multi-phase security audit of a codebase.cloudflare/security-audit-skill

GitHub Download source
Stars
56.8k
Forks
3.7k
Licence
MIT
Language
JavaScript
Last update
2 months ago
Type
AI model / agent

What it is

This is a skill for coding agents that turns the agent into a security auditor. It runs an audit in six phases: mapping the code, hunting for issues with isolated sub-agents, checking each candidate with a fresh verifier, writing structured findings, re-verifying the records, and producing reports. It was derived from the system Cloudflare uses for its own vulnerability discovery work.

  • Ask the agent to run a security audit of a directory such as ./src
  • Generate REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md for a project
  • Re-audit a repo over multiple runs to target gaps and revalidate changed source
  • Use the bundled Node.js validators to check findings.json and the coverage ledger

Great for

  • Teams using a coding agent that want a structured security review of a codebase
  • Security engineers exploring AI-driven audit workflows
  • Developers who want findings in machine-readable form with source traces
  • People running repeated audits on the same repo, since prior results are reused

Not ideal for

  • Anyone wanting a turnkey scanner without an AI coding agent, because it requires one that supports tool use and parallel sub-agents
  • Teams that cannot provide an OS-enforced sandbox, since the README says target code should not be executed without one and findings will stay as unvalidated leads
  • Users who only need a quick lint-style check, since this is a multi-phase process
Step-by-step guide: how to use security-auditInstall, first run, examples, tips and FAQs

How to get it

  1. 1

    See the README

    You'll need: Node.js (for the zero-dependency validators) · A coding agent that supports tool use and parallel sub-agents · Skills CLI via npx

    Install the skill with the Skills CLI

    npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

    Install globally for a user-level installation

    npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit --global
  2. 2

    Run it

    • Install the skill with the npx command above
    • Start your coding agent in the codebase you want to audit
    • Ask it to run a security audit, for example: security audit this codebase
    • Review the generated reports and findings in the output directory
  3. 3

    Get the most out of it

    • Specify an output directory, such as ~/audits/my-project, to control where artifacts go
    • Run the audit multiple times, since the README says runs are additive and reuse prior ledgers
    • Use the validate-findings.cjs and validate-coverage-ledger.cjs validators to check output
    • Provide an OS-enforced sandbox if you want target code executed during validation

Downloads

Source code (.zip)main branch · straight from GitHub

Strengths

  • Separates finding from verification, so a checker is never the agent that found the issue
  • Produces structured, schema-validated output with explicit verdicts
  • Supports additive runs that build on earlier ledgers and findings

Trade-offs

  • Requires a coding agent with tool use and parallel sub-agents, plus a sandbox for executing target code
  • The README's own test claim (a single run found about half of what repeated runs found) is from Cloudflare's internal tests and is not independently verified here

Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.