Cloudflare security-audit skill

What it is

security-audit is Cloudflare’s skill that turns a coding agent into a security auditor. It runs isolated agents through six phases, and the agent that finds a lead never confirms it: a fresh verifier tries to disprove it first. Cloudflare says this skill was the seed of its own system for finding vulnerabilities, which later grew into a multi-stage setup across its fleet. The repository holds the single-repo starting point.

1. Reconnaissance maps the architecture and trust boundaries
2. Hunters work through a coverage ledger
3. A fresh verifier tries to disprove each candidate
4. Records go to findings.json, checked against a schema
5. Fresh agents verify each final source claim
6. Reports are built from the verified records

Who it suits

Developers and security engineers who own a service, a library or a CLI and want a structured audit from the agent they already use. Small teams without security staff get a method that keeps what is proven apart from what is only suspected.

Skip it if you need a test of a live system: it reads source and never probes deployed endpoints.

Where to use it

Cloudflare names no product. It runs wherever these hold:

• Your coding agent: any whose model supports tool use and parallel sub-agents
• The skills installer: it finds the agents on your computer and asks which of them gets the skill
• Your codebase: a service, a library or a CLI, read from its source
• A sandbox: only for the steps that run target code, such as builds, tests and fuzzers

How to set it up

Get it saves a zip of Mindket’s setup notes in your downloads folder, with the install command from Cloudflare’s README. The install adds one skill, security-audit: SKILL.md, 14 more Markdown playbooks, report-schema.json and two Node validators with no dependencies.

1. Open a terminal and run the install line below.
2. Pick which of your agents gets the skill when the installer asks.
3. Add --global for a user-level install instead of a project one.
4. Before any target code runs, set up an OS-enforced sandbox with external networking off.

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit \
  --global

For agent selection and installs that ask nothing, the README points to the installer’s help.

npx skills --help

How to use it

Start your agent in the codebase you want audited, or point it there, and ask in plain words. The skill starts on its own when a request matches, and the request decides the mode.

One of the README’s plain requests:

find security vulnerabilities in ./src

To pick the output folder, name it.

do a security review, output to ~/audits/my-project

Example

In a web service you maintain, you ask for the full audit and let the agent work through all six phases.

security audit this codebase

With no folder named, the run lands in ~/security-audit-skill/<repo-name>/run-<N>. Every record goes into findings.json, checked against report-schema.json, with a coverage ledger beside it. REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md are then built from the verified records. Each record carries one of three statuses.

For newcomers and experts

If you are new. A security audit looks for ways someone could misuse your code. This skill makes your agent work like an auditor, and a second, fresh agent tries to knock down each suspected problem before it counts. Start in guidance mode with one question, such as how a single route handles bad input.

For experts. Severity needs impact, likelihood times impact, not a miss on a checklist. A missing second layer behind a first one that holds is a hardening note, not a vulnerability. Two zero-dependency validators check coverage-ledger.json and findings.json after each update. Runs add up: a later one reuses earlier ledgers and findings to aim at gaps and revalidate changed source. In Cloudflare’s test runs, one run found roughly half of what repeated runs found in total.

Good to know

It reads, and it keeps away from anything live.

• Source reading: read-only
• Off limits: deployed endpoints, external services and production identities, with dummy principals and secrets in their place
• Sandbox: besides networking off, it needs a sanitized allowlisted environment, resource limits and writes kept to scratch paths. Without one, leads stay needs_validation
• Your repository: written to only when you pick a folder there that version control ignores
• Model provider: the code your agent reads goes to it, as in any agent session
• Usage data: the skills installer sends anonymous usage data unless DISABLE_TELEMETRY=1 or DO_NOT_TRACK=1 is set
• License: MIT