Cloudflare reworks its open source security audit skill for coding agents
The open source security-audit skill that seeded Cloudflare's own vulnerability discovery system was rebuilt end to end in September. It runs a six-phase audit through a coding agent, and the agent that checks a finding is never the one that found it.
Cloudflare's open source security-audit skill, which turns a coding agent into a security auditor, was reworked end to end in September. The skill first shipped on 18 June alongside a company blog post. A 10 September update rewrote the audit workflow, the findings format and the validators. The GitHub repository now has more than 20,000 stars. It is MIT licensed and free.
A six-phase audit
You point your coding agent at a codebase and ask for a security audit. The skill then runs six phases:
- Reconnaissance: It maps the architecture, trust boundaries and input surfaces.
- Coverage-led hunting: A separate agent is assigned to each attack class.
- Candidate validation: Each candidate goes to a fresh verifier that tries to disprove it.
- Structured output: Results are written to a JSON file checked against a schema.
- Independent record verification: Fresh agents recheck the final findings against the source.
- Reporting: Reports are generated from the verified records.
The core rule is that the agent that checks a finding is never the agent that found it. Each finding ends up as confirmed, needs validation or rejected. If one layer already blocks an attack, Cloudflare treats the missing second layer as a hardening note, not a vulnerability.
Limits
Cloudflare says a single run finds roughly half of what repeated runs find in total, so the skill reads earlier ledgers and findings to target gaps. Running target code requires an OS-enforced sandbox with external networking disabled. Without it, the skill does not execute the code and leaves the lead as needs validation. It also needs a coding agent that supports parallel sub-agents, plus Node.js.
According to Cloudflare, this skill seeded the vulnerability discovery harness the company now runs across 128 repositories. In its June post, the company recommends keeping that system model-agnostic, with different models doing discovery and validation.
Sources: Cloudflare security-audit-skill repository, Cloudflare blog: Build your own vulnerability harness.
