security-audit-skill
Cloudflare's open-source coding-agent skill for multi-phase security audits producing independently verified, machine-readable findings.
Overview
Cloudflare open-sourced security-audit-skill under MIT in June 2026 and publicly detailed it in a blog post on September 17, 2026; by then it had reached 7,481 GitHub stars and 430 forks. It orchestrates isolated coding-agent runs through reconnaissance, coverage-led vulnerability hunting, candidate validation, structured output, and independent re-verification, on the premise that a model's first answer about a vulnerability is only a candidate finding, not a confirmed one. The repository ships one attack-family module per file, including memory corruption, prompt injection, HTTP request framing, and tenant isolation, and is the single-repo skill that seeded Cloudflare's larger internal vulnerability-discovery harness.
This is a sourced directory entry. Features and capabilities are reported in the linked sources; this entry does not document independent Aymorphic testing.
Key features
- Multi-phase pipeline: reconnaissance, coverage-led hunting, candidate validation, structured reporting, independent re-verification
- Treats a model's first vulnerability claim as an unverified candidate requiring separate confirmation
- One module per attack family (memory corruption, prompt injection, HTTP request framing, tenant isolation)
- Machine-readable, structured findings output
- MIT-licensed and installable as a skill for coding agents
Use cases
- Running automated, agent-driven security audits on a codebase
- Reducing false-positive vulnerability reports via independent re-verification
- Bootstrapping a larger internal security-audit pipeline (per Cloudflare's own usage)
Pricing
Free and open-source (MIT license).
Pricing reflects the source record and may change. Confirm current terms with the provider.
Dates and sources
- Released
- 1 Jun 2026
- Record updated
- 22 Sept 2026
- Record last checked
- 22 Sept 2026