CODING AGENT / DEV TOOL · ESSENTIAL

Cloudflare security-audit skill

Open-source agent skill from Cloudflare that runs a multi-agent security audit of a codebase, with findings independently re-checked.

Visit github.com ↗

What Cloudflare security-audit skill does

An MIT-licensed skill you install into a coding agent (via npx skills add). It runs reconnaissance, parallel "hunter" agents per attack class, separate verifier agents that try to disprove each finding, schema-validated findings.json, and a final report. Cloudflare says it seeded its internal vulnerability-discovery harness.

Good for

Security reviews of your own codebase with a coding agent
Teams building their own AI vulnerability-hunting pipeline
Getting structured, re-verified findings instead of a wall of maybe-bugs

Try this in 10 minutes

Honest take

No red flags in our notes so far

A serious, well-structured piece of work from a credible security team, and its key idea (the agent that finds a bug never checks it) is sound. But it's a prompt-and-workflow pack, not a scanner: results depend on your agent and model, it needs a proper network-isolated sandbox to confirm anything, and Cloudflare's own tests show one run finds only about half of what repeated runs find. We ran its bundled validator tests (65/65 passed) but haven't run a full audit hands-on.

Our Hype or Fact? checks

FactDoes Cloudflare's security-audit skill really turn your coding agent into a security auditor? 4 Nov

Pricing

Free (MIT). You pay for your coding agent's model usage; full audits run many parallel sub-agents, so token costs can be high.

Prices as listed by the maker when we last checked (2026-11-04); usually in US dollars. Check the website for current prices.

Latest update

4 November 2026: 2026-11-04: Added. Released 18 Jun 2026 alongside Cloudflare's 'Build your own vulnerability harness' post; workflow and validators reworked in Sept 2026 (last commit 14 Sep). About 58.8k GitHub stars, MIT.