Cloudflare security-audit-skill: AI Agent Security Auditor

Cloudflare’s security-audit-skill — an open-source tool that turns your coding agent into a structured security auditor — hit #1 on GitHub trending this week with 14,500 new stars in seven days. The number is notable, but the design is what’s worth paying attention to. Unlike almost every other AI security scanner, this one assumes its own findings are wrong until proven otherwise.

The Problem With AI Security Scanners

Ask a language model to find security bugs, and it will find security bugs. Some will be real. Some will be hallucinated with complete confidence. The standard fixes — prompt engineering, chain-of-thought, careful system prompts — don’t address the root issue: you’re asking the same model that generated a candidate finding to also decide if it’s valid.

Cloudflare’s adversarial architecture takes a different stance. The agent that finds a vulnerability is never the agent that validates it. A fresh, isolated sub-agent is handed each candidate and tasked with disproving it — checking assumptions, tracing the source path, verifying the affected principal and security outcome. Only findings that survive the challenge make it into the final report.

The effect on false positives is measurable. Cloudflare’s internal data shows the rate dropped from 40% to 11% after adversarial validation was added. Across 128 internal repositories, the pipeline processed 20,799 raw candidates, 12,057 passed validation, and 7,245 were actionable after deduplication.

Six Phases, Each Run in Isolation

The skill orchestrates six sequential phases, each using isolated sub-agents to prevent cross-contamination of findings:

1. Reconnaissance — Maps architecture, trust boundaries, and input surfaces. Outputs architecture.md and coverage-ledger.json.
2. Coverage-led hunting — Assigns independent hunter agents to ledger units. Coverage critics identify gaps.
3. Candidate validation — Each unique finding goes to a fresh verifier that tries to disprove it.
4. Structured output — Confirmed, needs_validation, and rejected records written to findings.json, validated against a schema.
5. Record verification — Fresh agents re-verify source claims in findings.json.
6. Reporting — Generates REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md.

The machine-readable output is deliberate. A findings.json you can pipe into a CI pipeline or ticketing system is more useful than a prose security report you have to parse manually.

Install and Run in Two Commands

The cloudflare security-audit-skill works with Claude Code, Codex CLI, Cursor, Cline, or any MCP-compatible agent. Installation takes one command:

# Add to current project
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

# Or install globally for all projects
npx skills add --global https://github.com/cloudflare/security-audit-skill --skill security-audit

To run it, tell your agent:

• "security audit this codebase" — full audit
• "find security vulnerabilities in ./src" — target a directory
• "do a security review, output to ~/audits/my-project" — custom output path

One hard requirement: the skill won’t run code without a sandbox that cuts network access, makes the target read-only, and enforces CPU and memory limits. This is a safety constraint built into the skill. If you’re using Claude Code’s built-in sandbox, you’re already covered.

Why It’s Trending in October, Not June

The repository launched in June 2026. It’s trending now because of a major restructuring on September 10 that rewrote the workflow, findings schema, and validators. The September update also added Guidance Mode — a lighter mode for targeted questions about specific code paths — alongside Full-Audit Mode. The tool circulating in Claude Code communities this week is substantially different from the one that shipped four months ago.

The timing also lines up with the expansion of the Claude Code skills ecosystem following Anthropic’s Mods launch. Developers building with agent skills are discovering what Cloudflare published and deciding it’s worth the token cost.

The Honest Tradeoffs

Token cost is real. At least one developer reported approximately one million tokens on a medium codebase. This is not a tool for every PR — it’s for a pre-release audit, a security review of a newly acquired codebase, or a periodic deep check on something critical.

Some models will also refuse prompts framed explicitly as security research. Guidance Mode and rephrasing without the word “security” are documented workarounds. It’s an annoying limitation that’s not unique to this skill.

It is also not a Snyk replacement. Snyk and SAST tools are fast and good at catching known vulnerability patterns in dependencies. Cloudflare’s skill looks for novel logic bugs, broken trust boundaries, and attack paths that pattern-matching won’t find. Use both.

How It Compares to Anthropic’s OSS Scanner

Developers will compare this to Anthropic’s OSS Scanner, which scans qualifying open-source projects and emails findings to maintainers. The difference is fundamental: Anthropic is a service that runs on your project on their infrastructure. Cloudflare gives you the methodology itself. You run it on your own infrastructure, on any codebase you have authorized access to, as often as you want. They solve adjacent problems.

Worth Running Today

If you’re using Claude Code or any MCP-compatible agent and you have a codebase with security exposure, there is no good reason not to at least run Guidance Mode on your riskiest code paths. The tool is free, the methodology is sound, and 43,000 developers starred it for a reason.

The repository is at github.com/cloudflare/security-audit-skill. Cloudflare’s write-up of the internal harness it was seeded from is at the Cloudflare blog. The Hacker News discussion is worth reading for real-world usage reports and limitations.