Security Audit
Security Audit (security-audit) is a skill by Cloudflare that turns a coding agent into a security auditor: it maps a codebase's trust boundaries, sends sub-agents to hunt for vulnerabilities, and has fresh agents try to disprove every candidate before it reaches the report.
Notes by Lior Pesoa · Updated · Works with Claude Code
Made by Cloudflare.
Source: github.com/cloudflare/security-audit-skill · MIT license. Everything below is my notes: why I use it and how.
npx skills add cloudflare/security-audit-skill --skill security-auditWhat it does
- Maps the codebase first: architecture, trust boundaries, inputs, and a coverage ledger of what still needs checking.
- Sends separate hunter agents to each part of the ledger, with attack guides for web, auth, AI and LLM features, mobile, cloud, supply chain and more.
- Gives every candidate bug to a fresh agent whose job is to disprove it. The agent that found a bug never checks it.
- Writes the results as confirmed, needs validation or rejected, checks them against a JSON schema, then writes a report with the smallest fix for each confirmed bug.
- Only runs code inside a locked-down sandbox and never probes live servers. Without a sandbox, it reports what it couldn't check instead of guessing.
When to use it
Before you launch, or before you hand a codebase to customers. Ask for a full audit to get the report files. For a single security question, the skill answers without running the whole audit. Run it more than once: Cloudflare found that one run catches about half of what repeated runs find.
How it works
- 01Reconnaissance: map the source and build the coverage ledger.
- 02Hunting: isolated agents work through the ledger, and critic agents look for gaps.
- 03Validation: a fresh agent tries to disprove each candidate.
- 04Structured output: findings go into findings.json and are checked by the included validators.
- 05Verification: more fresh agents re-check the final claims against the source.
- 06Reporting: REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md, written from the verified records.
Questions
Who made security-audit?
Cloudflare. It's published at github.com/cloudflare/security-audit-skill under the MIT license. It's the starting point for the vulnerability harness Cloudflare describes in Build your own vulnerability harness (opens in a new tab).
Does it change my code?
No. It describes fixes but doesn't edit your source. Reports go to ~/security-audit-skill/<repo-name>/run-<N> unless you pick another folder.
Does it work outside Claude Code?
It's written for any coding agent that can run sub-agents in parallel. It also needs Node.js for its two validators.
Is it expensive to run?
A full audit runs many agents. You can ask for a quick run, limit it to some folders, or set a budget as a maximum number of agent runs.