Cloudflare's open security-audit skill turns coding agents into bug hunters

Cloudflare's free, MIT-licensed security-audit skill plugs into coding agents like Claude Code or Cursor and runs a six-phase audit: map the code, send parallel "hunter" agents after each attack class, then have separate agents try to disprove every finding before anything lands in the report. Cloudflare says it's the seed of its internal vulnerability-hunting system. It came out on 18 June and was reworked in September, so it's not brand new, but it's now at about 58.8k GitHub stars. Fact or hype: Fact. It's real and well-designed, but it's a method, not a scanner, and results depend on your agent and sandbox.

Why it mattersAI agents are writing more and more code, and this is one of the most credible free ways to point them at your own security. The best idea to copy is that the finder never verifies its own bug. Expect real model costs and run it in an isolated sandbox. We ran its validator tests but haven't run a full audit hands-on.

Curated by Sara Simeone as part of our human editorial coverage. The original sources are linked below; curation is distinct from a Hype or Fact? assessment.

SHARE THISPost on X ↗Share on LinkedIn ↗Copy link

How we knowCompany figures are labelled as their own claims; anything we couldn't verify is labelled as a report or a claim.