HYPE OR FACT? · CHECKED 4 NOVEMBER 2026
Does Cloudflare's security-audit skill really turn your coding agent into a security auditor?
OUR VERDICT
FactOur original verdict: “Largely yes, with caveats. It's a real, MIT-licensed skill from Cloudflare that gives an agent a careful six-phase audit method, with separate agents checking every finding, and Cloudflare says it grew into its internal bug-hunting system. But it isn't new (released 18 June 2026), it's instructions rather than a scanner, and the quality depends on your agent, your model and a proper sandbox. We ran its validator tests but haven't run a full audit hands-on.”
THE CLAIM
“Cloudflare says the skill "turns your agent into a security auditor" and is "the skill that seeded Cloudflare's vulnerability discovery harness".”
What’s actually true
- The repo cloudflare/security-audit-skill is MIT-licensed and was created on 18 Jun 2026, the same day as Cloudflare's blog post 'Build your own vulnerability harness'. It has 14 commits, mostly by one Cloudflare engineer, and was last updated on 14 Sep 2026. It has about 58.8k stars and 3.8k forks.
- Six phases: reconnaissance with a coverage ledger; parallel 'hunter' agents per attack class; fresh verifier agents that try to disprove each candidate; schema-checked findings.json; independent re-verification; and a report. The agent that finds a bug never validates it.
- It covers web and auth, AI/LLM prompt injection, client-side, supply chain, cloud/IaC, RPC/messaging, data isolation, memory safety and mobile/desktop IPC. That's about 2,000 lines of instructions plus two zero-dependency Node validators.
- We ran the bundled validator test suites in our sandbox: 65 of 65 passed. That checks the JSON-format validators, not audit quality.
- Cloudflare's own figures: its wider harness built from this skill holds 13,841 findings across 145 repos, 5,442 of them folded away as duplicates (blog). In Cloudflare's test runs, a single run found 'roughly half' of what repeated runs found.
- Requirements: an agent with tool use and parallel sub-agents, Node.js, and an OS-enforced sandbox with no outside network. Without one, leads stay 'needs_validation' rather than being confirmed by running code.
Sources
Cost
Free and open source (MIT). Your model usage is the real cost, and many parallel sub-agents per audit add up.
USE IT IF
Developers and small teams who already use a coding agent (Claude Code, Cursor and similar) and want a structured security pass over their own code.
SKIP IT IF
Anyone wanting a push-button scanner or a replacement for a professional pentest, or anyone auditing code they don't own or have permission to test.
How we knowChecked on 4 November 2026. Verdicts: Fact = the claim holds up; Partly fact = real, but with caveats or overstated parts; Hype = the headline claim isn't supported. Products change quickly, so check the maker's site before you buy. Our methods & sources ↗