Cloudflare has published Security Audit Skill, an open-source skill that turns AI coding agents into structured security auditors capable of examining repositories, identifying potential vulnerabilities, independently validating findings, and producing machine-readable reports. Available on GitHub under the MIT license, the project introduces a six-phase workflow designed to reduce false positives and make security reviews more repeatable. For sysadmins, DevOps engineers, and security teams, it offers a way to bring more systematic vulnerability checks into existing AI-assisted development workflows.

Security Audit Skill: The Key Points in 20 Seconds

Cloudflare’s skill organizes repository security audits into six distinct phases.
Independent AI agents investigate and attempt to disprove potential vulnerabilities.
Findings are classified as confirmed, needing validation, or rejected.
Coverage ledgers track what has been inspected across repeated audit runs.
It requires a coding agent with parallel sub-agent support, Node.js, and an OS-enforced sandbox.

The project addresses a familiar problem with AI-assisted security reviews: finding suspicious code does not necessarily mean finding an exploitable vulnerability. An agent may identify an unsafe-looking function or missing validation without understanding that another component already enforces the required security boundary.

Security Audit Skill takes a more disciplined approach. Instead of relying on a single agent to inspect code and produce a list of potential issues, it separates reconnaissance, vulnerability hunting, candidate validation, and final reporting. Different agents handle different responsibilities, and the system requires evidence before promoting a candidate to a confirmed finding.

Cloudflare says the skill was the starting point for its vulnerability discovery harness, which later evolved into a multi-stage system capable of operating across its wider fleet. The published project provides the single-repository starting point for that approach.

Six phases for a more structured security audit

Security Audit Skill organizes its workflow into six phases, each producing information that feeds into the next stage.

1. Reconnaissance

The first phase maps the repository architecture, trust boundaries, input surfaces, and available evidence. It produces two important artifacts:

architecture.md, which documents the application’s architecture and security boundaries.
coverage-ledger.json, which records the areas and checks that need to be covered.

This initial mapping gives the subsequent agents a more precise understanding of the codebase instead of asking them to search blindly.

2. Coverage-led hunting

The skill assigns isolated hunting agents to specific units recorded in the coverage ledger. Each agent documents the checks it performs, while separate coverage critics look for gaps in the investigation.

This approach is particularly useful for larger repositories, where a single agent may overlook entire components or repeat the same checks without making progress.

3. Candidate validation

Every unique vulnerability candidate is handed to a fresh verifier. Its job is to challenge the original claim and try to disprove it.

This separation is central to the design. The agent that discovers a potential vulnerability is not the one responsible for confirming it. The verifier must establish whether the source code supports the claim and whether the reported behavior can actually be demonstrated.

4. Structured findings

The fourth phase writes the results into findings.json, using a defined JSON schema.

Every candidate receives one of three verdicts:

confirmed: a complete source trace and bounded observed result support the vulnerability.
needs_validation: an exact unresolved fact prevents confirmation, so the issue remains open without an assigned severity.
rejected: the candidate has been disproved.

This distinction matters for security teams because it prevents unverified suspicions from being presented as confirmed vulnerabilities.

5. Independent record verification

Fresh agents review the final records and verify the source-level claims. If a finding is materially replaced during this stage, another independent verifier must review the replacement.

The goal is to ensure that the final report remains grounded in the actual source code rather than relying on an earlier agent’s interpretation.

6. Target-neutral reporting

The final phase generates three reports from the verified findings and coverage ledger:

REPORT.md: the main audit report.
FINDINGS-DETAIL.md: detailed information about findings.
NEEDS-VALIDATION.md: candidates that still require additional investigation.

The output is designed to be consumed by developers and security teams without depending on a specific application or repository structure.

Coverage tracking and repeatable audits

One of the more interesting features for infrastructure and platform teams is the coverage ledger.

Security Audit Skill is designed to support multiple audit runs against the same repository. Rather than starting from scratch every time, subsequent runs can use previous findings and coverage records to identify gaps, revalidate changed source code, and investigate areas that were not fully examined.

Previous evidence is not automatically treated as current. If the source code changes, the relevant checks may need to be repeated. Likewise, unresolved findings do not count as completed coverage.

The project includes two zero-dependency JavaScript validators:

validate-findings.cjs checks the structure and validity of findings.json.
validate-coverage-ledger.cjs validates the coverage ledger throughout the audit process.

Both validators are accompanied by test files, allowing the expected output structure to be checked independently of the AI agents performing the investigation.

The skill also includes specialized hunting guidance for different attack surfaces. Its documentation covers memory safety, kernel and native code, prompt injection, LLM tool handling, HTTP request framing, authentication, client-side vulnerabilities, software supply chains, cloud infrastructure, RPC, messaging, resource exhaustion, tenant isolation, mobile applications, and local IPC.

For sysadmins and DevOps teams, the cloud and deployment coverage is particularly relevant. It includes areas such as IAM permissions, infrastructure as code, containers, serverless environments, ingress configuration, and runtime settings.

Installation and requirements

Security Audit Skill can be installed using the Skills CLI:

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-auditCode language: JavaScript (javascript)

For a user-level installation, add the --global option:

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit \
  --globalCode language: PHP (php)

Once installed, start a compatible coding agent inside the repository to be audited and issue a request such as:

security audit this codebaseCode language: JavaScript (javascript)

More focused requests are also supported:

find security vulnerabilities in ./src

Or specify where the reports should be written:

do a security review, output to ~/audits/my-projectCode language: JavaScript (javascript)

A full audit automatically activates the six-phase workflow. If no output directory is specified, the default location is:

~/security-audit-skill/<repo-name>/run-<N>Code language: HTML, XML (xml)

The workflow requires a coding agent with tool-use capabilities and parallel sub-agent support. Node.js is needed for the validation scripts.

There is also an important infrastructure requirement: an OS-enforced sandbox.

Cloudflare requires an isolated environment for target-controlled builds, tests, processes, browsers, emulators, fuzzers, and fixtures. The sandbox must disable external networking, use a sanitized allowlisted environment, enforce resource limits, and restrict writes to assigned scratch directories.

Without these protections, the workflow keeps affected findings in needs_validation rather than executing potentially untrusted target code.

This is an important distinction for production environments. A security audit should not introduce additional risks by running untrusted build scripts or tests with unrestricted access to credentials, networks, or host resources.

What this means for sysadmins and DevOps teams

Security Audit Skill offers a practical way to introduce multi-agent security reviews into software development and infrastructure workflows.

For sysadmins responsible for maintaining services, containers, deployment pipelines, and internal applications, the ability to inspect repositories with dedicated checks for IAM, runtime configuration, supply-chain security, and resource exhaustion can be useful.

Its structured output also makes it easier to separate confirmed vulnerabilities from issues that need further investigation. That distinction can help teams prioritize remediation work and avoid filling security backlogs with unverified AI-generated warnings.

However, the project should not be treated as a replacement for professional penetration testing, code review, or established security tooling. Its own design principles acknowledge that repeated runs improve coverage but do not guarantee that every vulnerability will be discovered.

Cloudflare’s approach is interesting because it treats AI security auditing as an evidence-driven engineering process rather than a simple prompt asking a model to find bugs. Independent verification, explicit coverage tracking, structured findings, and sandboxed execution provide a more controlled foundation for using coding agents in security work.

Frequently Asked Questions

What is Cloudflare Security Audit Skill?

It is an open-source skill for AI coding agents that organizes repository security audits into six phases, from architectural reconnaissance to independent finding verification and report generation.

Which AI agents does Security Audit Skill support?

It requires a coding agent capable of using tools and running parallel sub-agents. The supplied project documentation does not provide a definitive list of supported models.

Does Security Audit Skill require Node.js?

Yes. Node.js is required to run its zero-dependency JavaScript validators for findings and coverage ledgers.

Can Security Audit Skill replace a penetration testing team?

No. It provides a structured way to investigate vulnerabilities with AI agents, but it does not guarantee complete coverage or replace professional security assessments.