Repolode
Submit
cloudflare

cloudflare/security-audit-skill

A coding-agent skill that runs multi-phase security audits with isolated agents, independent verification, and machine-readable findings.

View on GitHub
Stars
31,361
Forks
1,964
Open issues
66
Last commit
last month

What is it?

security-audit is a skill for coding agents such as Claude Code that turns the agent into a structured security auditor. It splits an audit into six phases: reconnaissance that maps architecture, trust boundaries and input surfaces; coverage-led hunting by isolated sub-agents; validation of each candidate by a fresh verifier that tries to disprove it; structured output in findings.json; independent re-verification of final source claims; and generation of a report from the verified records.

Each finding gets one of three verdicts: confirmed (with a complete source trace and bounded observed result), needs_validation (an exact unresolved fact, no severity), or rejected (a disproved candidate). Zero-dependency Node.js validators check the coverage ledger and findings file against a JSON schema. Repeated runs on the same repository are additive, so later runs target coverage gaps and revalidate changed source.

The project is the starting point of the vulnerability discovery harness Cloudflare described in its blog. Attack-class prompts cover areas such as memory safety, LLM-backed applications, web protocols and auth, client-side code, supply chain, cloud deployment, RPC and messaging, and desktop or mobile IPC.

Key features

  • 01Runs a six-phase audit from reconnaissance through verified reporting.
  • 02Assigns isolated hunters and coverage critics to track which code has been checked.
  • 03Gives each candidate to a fresh verifier that attempts to disprove it.
  • 04Outputs confirmed, needs_validation and rejected records validated against a JSON schema.
  • 05Provides attack-class prompt files for memory safety, LLM apps, web auth, cloud, supply chain and more.
  • 06Supports additive repeated runs that revalidate changed source.

Use cases

  • Running a structured security review of a codebase with a coding agent.
  • Auditing an LLM-backed application for prompt injection and tool misuse.
  • Reviewing a repository's CI, release and dependency configuration for supply-chain risks.
  • Repeating audits over time to cover gaps and recheck changed code.

Quick start

  1. 1

    Install the skill with the Skills CLI

    npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit
  2. 2

    Optionally install globally for a user-level installation

    npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit --global
  3. 3

    Start your coding agent in the target codebase and ask for a security audit

    security audit this codebase

Things to know

  • Full audits running target code need an OS-enforced sandbox with no external networking, otherwise leads stay as needs_validation.
  • Requires a coding agent with tool use and parallel sub-agents, plus Node.js for the validators.

Topics

#security#security-audit#ai-agent#vulnerability-scanning#code-review#claude-code#llm

FAQ

What is security-audit-skill?
A coding-agent skill that runs multi-phase security audits with isolated agents, independent verification, and machine-readable findings. security-audit is a skill for coding agents such as Claude Code that turns the agent into a structured security auditor. It splits an audit into six phases: reconnaissance that maps architecture, trust boundaries and input surfaces; coverage-led hunting by isolated sub-agents; validation of each candidate by a fresh verifier that tries to disprove it; structured output in findings.json; independent re-verification of final source claims; and generation of a report from the verified records.
Is security-audit-skill free to use? What license does it have?
security-audit-skill is open source under the MIT license. Check the license terms before using it in commercial products.
Is security-audit-skill still maintained?
Updated within 6 months. The last commit to security-audit-skill was on Sep 14, 2026.
What can I use security-audit-skill for?
Running a structured security review of a codebase with a coding agent. Auditing an LLM-backed application for prompt injection and tool misuse. Reviewing a repository's CI, release and dependency configuration for supply-chain risks. Repeating audits over time to cover gaps and recheck changed code.
How do I install security-audit-skill?
Install the skill with the Skills CLI: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit Optionally install globally for a user-level installation: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit --global Start your coding agent in the target codebase and ask for a security audit: security audit this codebase
Where can I get security-audit-skill?
The source code and installation instructions are on GitHub: https://github.com/cloudflare/security-audit-skill

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects