Cloudflare's security-audit skill packages the workflow that seeded the company's internal vulnerability discovery harness into a single skill any capable coding agent can load. Ask the agent to security-audit a codebase or find vulnerabilities in a directory, and the skill activates and coordinates isolated sub-agents instead of letting one agent grade its own work.
A full audit runs six phases: reconnaissance that maps architecture, trust boundaries and input surfaces into an architecture file and a coverage ledger; coverage-led hunting by isolated hunters with coverage critics looking for gaps; candidate validation, where each unique candidate goes to a fresh verifier that tries to disprove it; structured output into confirmed, needs_validation and rejected records validated against a report schema; independent re-verification of final source claims; and target-neutral reports derived from the verified records.
Attack-class guides cover web protocols and authentication, client-side issues, memory safety and binaries, and AI/LLM risks such as prompt injection and agent tool misuse. Repeat runs on the same repository are additive and target remaining gaps. The skill only confirms established boundary failures; if target code would have to run without an OS-enforced, network-disabled sandbox, it keeps the lead as needs_validation rather than executing it.
It requires a coding agent with a model that supports tool use and parallel sub-agents, plus Node.js for the zero-dependency validators, and installs with npx skills add (optionally --global). The skill is MIT-licensed and free; token costs depend on your agent and model.
