⚡️ Skill of the Week: Cloudflare security-audit

Cloudflare open-sourced the skill that started its own vulnerability-finding system. It turns Claude Code, or any coding agent, into a security auditor for your codebase. It has 37,541 stars on GitHub.

https://github.com/cloudflare/security-audit-skill

An audit runs in six phases:

1. Recon. It maps your architecture, where data comes in and where the trust boundaries sit.

2. Hunting. Separate agents each take a slice of the code and record what they checked, so the gaps show up.

3. Validation. Every candidate goes to a fresh agent whose only job is to disprove it.

4. Output. Each finding is saved as confirmed, needs validation or rejected, then checked against a schema.

5. Re-verification. New agents check the final claims against the source again.

6. Report. You get REPORT.md plus a detail file and a needs-validation list.

The rule that makes it worth using: the agent that checks a finding is never the agent that found it. A missing extra layer of defence is logged as a hardening note, not a vulnerability, so the report is not padded.

Run it more than once. In Cloudflare's own tests a single run found roughly half of what repeated runs found in total. Each new run builds on the last.

You need an agent that can run parallel sub-agents, plus Node.js. To let it execute your code it also needs a locked-down sandbox. Without one, it will not run your code and keeps those leads as needs validation.

Install it with:

npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

Then open your project and type: security audit this codebase

It's free and MIT licensed.

If you have a vibe-coded app live right now, what would you want it to check first?

0 comments

⚡️ Skill of the Week: Cloudflare security-audit