Security Audit Skill by Cloudflare
Turns a coding agent into a multi-phase security auditor producing independently verified, machine-readable, source-evidenced vulnerability findings.
The skill shows strong least-privilege and safety design: read-only source inspection, target code executed only in a strict OS sandbox (no network, allowlisted empty environment, read-only target, scratch-only writes, resource limits), an exhaustive race-safe artifact-promotion procedure, explicit prohibition of probing production endpoints or producing persistence material, and needs_validation fallbacks instead of proceeding. Deducted because: the complex sandbox/promotion requirements may be unenforceable on many hosts, rollback/cleanup relies mainly on discard semantics, and there is no validation of the trusted parent-side promotion implementation itself.
SKILL.md is highly self-consistent: mode separation, budget gates, and exactly two terminal states are well defined, with explicit incomplete_reason mechanisms for abnormal paths. Deducted because: it depends on companion files (RECONNAISSANCE.md, HUNTING.md, etc.) and tooling (report-schema., validate-findings.cjs, validate-coverage-ledger.cjs) not present in the provided evidence; key paths could not be statically reproduced and cross-file consistency is unverified given the workflow's high complexity.
The description and Operating Modes define precise trigger conditions (full workflow only on explicit audit/pen-test/comprehensive-review requests), ask one clarifying question when ambiguous, and clearly delimit guidance vs full-audit boundaries and non-fit cases. Deducted because: documentation is English-only with no Chinese-language support; minimum platform capabilities (Task tool, sandbox controls) are assumed without a stated degradation path beyond needs_validation.
MIT license, layered docs with progressive block-level injection into agent prompts, explicit file contracts, canonical agent-ID rules. Deducted because: publisher identity is unverified, and no version number, changelog, maintainer ownership, or update path is disclosed; install/dependency notes are implicit (local tools only), with no FAQ or known-limitations list.
The value claim — structured, independently verified, machine-readable findings plus smallest effective fixes — is plausible and design-supported. Deducted because: static review cannot verify that outputs are directly usable; the validators and schema were not evidenced, and finding quality depends entirely on an unexecuted, complex workflow.
Traceability is well designed: evidence contracts, fingerprints, coverage ledgers, and required exact missing facts for needs_validation records. Deducted because: only source text is available; there is no committed test suite, CI run, or third-party execution evidence covering the key paths, so conclusions are not independently reproducible from this material.
- Sandbox, empty-environment, retained-descriptor, and race-safe promotion controls may not be fully enforceable on many agent platforms; the skill downgrades to needs_validation when unavailable, so users should expect full-audit runs to frequently end incomplete.
- Companion files and validators (RECONNAISSANCE.md, HUNTING.md, report-schema., validate-findings.cjs, validate-coverage-ledger.cjs) were not present in the reviewed evidence; verify their existence and consistency before use.
- Publisher identity is unverified, and no version or update path is disclosed, creating uncertainty about long-term maintenance.
- Documentation is English-only; full-audit mode may consume significant tokens/agent invocations — set a budget and accept possible incomplete outcomes.
What does this skill do, and when should you use it?
This is Cloudflare's open-source coding-agent skill, distilled from the single-repo origin of its internal vulnerability discovery harness. It runs a six-phase workflow: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. Its core discipline is confirming only vulnerabilities that cross a real trust boundary — a missing best practice is never a finding. Every confirmed record requires a source trace, a bounded local reproduction, and independent verification; unresolved leads stay as needs_validation without severity. Repeat runs on the same repo are additive, using prior ledgers to fill gaps and revalidate changed source.
In full audit mode it maps architecture and trust boundaries into architecture.md and a coverage-ledger.; dispatches isolated hunter sub-agents against ledger units with coverage critics checking for gaps; gives every candidate to a fresh verifier that tries to disprove it; writes confirmed / needs_validation / rejected records to findings. validated by zero-dependency Node.js validators (validate-findings.cjs, validate-coverage-ledger.cjs); then has fresh agents independently re-verify final records before generating REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md. Any target-controlled build, test, browser, or fuzz run must execute inside an OS sandbox with no external network, allowlisted environment, resource limits, and scratch-only writes; file promotion is done by parent-side race-safe steps with no-follow traversal and fstat checks. It offers quick / standard / deep profiles, scoped runs, and a strict agent-invocation budget gate.
- A security engineer runs a comprehensive pre-release audit of an owned codebase and wants an archivable, machine-readable report.
- A maintainer re-runs the audit after a fix so prior ledgers drive revalidation of changed source and gap-filling.
- An open-source triager scopes an audit to one subsystem, named paths, or the diff between two commits.
- A security team caps agent invocations with a strict budget for a bounded first pass on a large target.
- A researcher targets native code or LLM-backed components using the companion attack-class files (memory safety, prompt injection, supply chain, etc.).
What are this skill's strengths and limitations?
- Strict evidence discipline: confirmed findings need a source trace, bounded reproduction, and verification by an agent that did not find them; needs_validation carries no severity.
- Real trust-boundary requirement, explicitly excluding checklist deviations and defense-in-depth advice from findings.
- Structured output with JSON Schema and zero-dependency validators keeps prose and data consistent.
- Additive multi-run coverage: Cloudflare's test runs found roughly half of total vulnerabilities in a single run.
- Careful execution-safety design: no-egress sandboxes, allowlisted environments, race-safe file promotion, budget gating.
- Requires a platform with tool use and parallel sub-agents plus an OS-level sandbox; in weaker environments the workflow degrades to needs_validation.
- A full six-phase audit consumes many agent invocations; a small budget can block reconnaissance entirely.
- quick and scoped runs are partial coverage by design and cannot be treated as a clean bill of health.
- No independent benchmarks or third-party evaluations in the source; the effectiveness figure comes only from Cloudflare's own test runs.
How do you install this skill?
Install with the Skills CLI: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit. Add --global for a user-level install. You can also copy the skill directory from skills/security-audit/ in the repo. No other installation methods are documented in the source.
How do you use this skill?
Start your coding agent in (or pointed at) the target codebase and issue an audit request such as: security audit this codebase, find security vulnerabilities in ./src, or do a security review, output to ~/audits/my-project. The skill activates automatically on matching triggers; output defaults to ~/security-audit-skill/<repo-name>/run-<N>, and it writes inside the target repo only if you explicitly pick a version-control-ignored directory. Node.js is needed for the zero-dependency validators; executing target-controlled code requires a qualifying OS sandbox, otherwise results stay needs_validation.
How does this skill compare with similar options?
The source names no direct competitor, but positions itself as the single-repo starting point of Cloudflare's fleet-wide vulnerability harness (see its blog post Build your own vulnerability harness) — better suited to one-repo audits than large-scale orchestration.