# Security Audit Security Audit (security-audit) is a skill by Cloudflare that turns a coding agent into a security auditor: it maps a codebase's trust boundaries, sends sub-agents to hunt for vulnerabilities, and has fresh agents try to disprove every candidate before it reaches the report. Skill · Picked · by Cloudflare · Works with Claude Code · Updated 2026-10-25 Made by [Cloudflare](https://www.cloudflare.com). Source: [github.com/cloudflare/security-audit-skill](https://github.com/cloudflare/security-audit-skill) · MIT license. The text below is Lior's notes on why and how he uses it; the original files live at the source. ## Install ```sh npx skills add cloudflare/security-audit-skill --skill security-audit ``` ## What it does - Maps the codebase first: architecture, trust boundaries, inputs, and a coverage ledger of what still needs checking. - Sends separate hunter agents to each part of the ledger, with attack guides for web, auth, AI and LLM features, mobile, cloud, supply chain and more. - Gives every candidate bug to a fresh agent whose job is to disprove it. The agent that found a bug never checks it. - Writes the results as confirmed, needs validation or rejected, checks them against a JSON schema, then writes a report with the smallest fix for each confirmed bug. - Only runs code inside a locked-down sandbox and never probes live servers. Without a sandbox, it reports what it couldn't check instead of guessing. ## When to use it Before you launch, or before you hand a codebase to customers. Ask for a full audit to get the report files. For a single security question, the skill answers without running the whole audit. Run it more than once: Cloudflare found that one run catches about half of what repeated runs find. ## How it works 1. Reconnaissance: map the source and build the coverage ledger. 2. Hunting: isolated agents work through the ledger, and critic agents look for gaps. 3. Validation: a fresh agent tries to disprove each candidate. 4. Structured output: findings go into findings.json and are checked by the included validators. 5. Verification: more fresh agents re-check the final claims against the source. 6. Reporting: REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md, written from the verified records. ## Questions ### Who made security-audit? Cloudflare. It's published at github.com/cloudflare/security-audit-skill under the MIT license. It's the starting point for the vulnerability harness Cloudflare describes in [Build your own vulnerability harness](https://blog.cloudflare.com/build-your-own-vulnerability-harness). ### Does it change my code? No. It describes fixes but doesn't edit your source. Reports go to `~/security-audit-skill//run-` unless you pick another folder. ### Does it work outside Claude Code? It's written for any coding agent that can run sub-agents in parallel. It also needs Node.js for its two validators. ### Is it expensive to run? A full audit runs many agents. You can ask for a `quick` run, limit it to some folders, or set a budget as a maximum number of agent runs. ## Related - [Supabase Postgres Best Practices](https://www.liorpesoa.com/library/supabase-postgres-best-practices.md) - [Find Skills](https://www.liorpesoa.com/library/find-skills.md) ## Credit Cloudflare · [github.com/cloudflare/security-audit-skill](https://github.com/cloudflare/security-audit-skill) · MIT license --- Page: https://www.liorpesoa.com/library/security-audit Library: https://www.liorpesoa.com/library