Cloudflare open-sources a coding-agent skill for multi-phase security audits

What Cloudflare released

Cloudflare has open-sourced security-audit-skill, a coding-agent skill that converts a general-purpose development agent into a structured security auditor. The repository, which surfaced on the Hacker News front page, is MIT-licensed and installs with the Skills CLI via a single npx skills add command. Once installed, it activates on its own when a request matches its triggers, phrases such as "security audit this codebase" or "find security vulnerabilities in ./src". A whole-codebase audit or pen-test request runs in full audit mode, while one-off security questions fall back to a lighter guidance mode.

According to the README, this is more than a demo: the skill is the starting point that grew into Cloudflare's vulnerability discovery harness, a multi-stage system run across a fleet and described in the company's write-up "Build your own vulnerability harness". The open-source package captures that methodology at a scale any team can run against a single repository.

Six phases from recon to report

The workflow orchestrates isolated sub-agents through six phases:

1. Reconnaissance. The system maps the architecture, trust boundaries and input surfaces, and records deterministic coverage in architecture.md and coverage-ledger..
2. Hunting. Hunter agents are assigned units from the coverage ledger, record what they checked, and "coverage critics" look for unexamined ground.
3. Candidate validation. Every unique candidate goes to a fresh verifier whose task is to refute it, not confirm it.
4. Structured output. Results land in findings. under three verdicts, confirmed, needs_validation and rejected, checked against report-schema..
5. Independent verification. Fresh agents re-check the final source claims, and any material replacement gets another independent verifier.
6. Reporting. REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md are derived from the verified records and the coverage ledger.

Zero-dependency Node validators for the ledger and the findings file run automatically after updates to keep the artifacts well-formed.

The verdicts are deliberately strict. A confirmed finding needs a full trace back to the source plus a bounded result that was actually observed. A needs_validation record carries one exact unresolved fact and is never assigned a severity. A rejected record documents a candidate that did not survive verification. Repeated runs against the same repository are additive: later runs reuse earlier ledgers and findings to target gaps, re-check changed code and carry forward valid evidence, without treating stale or unresolved work as done.

Guardrails, requirements and hunting guides

The skill assumes an agent that supports tool use and parallel sub-agents, plus Node.js for the validators. More notably, it requires an OS-enforced sandbox for anything target-controlled, builds, tests, browsers, emulators, fuzzers, fixtures. That sandbox must cut off external networking, run with a sanitised allowlisted environment, cap resources and confine writes to assigned scratch paths. Without those controls, the workflow refuses to execute target code at all and leaves the lead sitting in needs_validation.

Several design principles stand out. The agent that checks a finding is never the agent that found it. Severity is judged as likelihood times impact, not on how far a result strays from a checklist. When one layer already blocks an attack, the absence of a second layer is a hardening note rather than a vulnerability. And iteration is built in: Cloudflare reports that a single pass in its own tests uncovered about half as many vulnerabilities as repeated runs did overall.

The package also ships roughly a dozen hunting guides covering attack classes across domains: memory safety, binary and kernel targets; prompt injection, agent-tool and output-handling risks in LLM-backed systems; HTTP request framing, caching and authentication protocols; client-side browser flaws; supply chain and release processes; cloud IAM and infrastructure-as-code; RPC, serialization and messaging; resource exhaustion; tenant data isolation and lifecycle; and desktop, mobile and local IPC surfaces.

Why it matters

Security review is quickly becoming a standard workload for coding agents, but ad-hoc prompting tends to produce plausible-sounding findings with no accountability. What Cloudflare has packaged here is the opposite: coverage accounting, adversarial verification, machine-readable output and an explicit refusal to claim more than was observed. The additive multi-run model is an honest concession that a single agent pass misses a lot, roughly half, by Cloudflare's own testing. For security and platform teams, the skill is both a usable tool and a template for making agent-driven auditing auditable itself; for Cloudflare, it publicises the method behind its vulnerability harness and invites collaboration via [email protected].