GitHub
cloudflare/security-audit-skill — A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings
SecurityFirst seen 2,878 points
Cloudflare has shared a free "skill" for AI coding agents that turns the agent into a security auditor. It runs a multi-step audit and checks its own findings. It is the starting point for Cloudflare's larger vulnerability-finding system.
What happened
Cloudflare published an open-source project called security-audit on GitHub. It is a "skill," which is a set of instructions that a coding agent (an AI helper that writes and edits code) can follow. The skill guides the agent through a full security audit of a code project. The audit runs in six phases: study the system, hunt for problems, test each possible problem, write results in a fixed format, have fresh agents double-check the results, and then write reports.
Key facts
- The audit has six phases.
- Each possible problem is checked by a new verifier agent whose job is to try to prove it wrong.
- Each finding gets one of three labels: confirmed, needs_validation (still unclear), or rejected (proven wrong).
- The results are saved in a machine-readable file called findings.json, which is checked against a schema (a fixed set of rules for the data).
- The project includes about 15 files, with separate hunting guides for areas such as memory safety, AI tools, cloud setup, web protocols, and mobile apps.
Where it came from
This skill is the first version of the tool Cloudflare used to find vulnerabilities internally. Cloudflare's larger system has grown into many stages and works across a whole fleet of systems. This repository is a simpler, single-project version that other people can use and learn from.
Why it matters
Security bugs are hard and slow to find by hand. A tool that splits the work among many agents, and forces each claim to be checked by a fresh agent, may help teams find real problems faster. Its rules also try to stop false alarms, because a finding only counts as confirmed when its source trail is complete. Teams that build their own checks can learn from this design.
What to watch
- Whether other teams use the skill and report how many real bugs it finds versus false alarms.
- How well the verifier agents catch errors in the findings.
- Whether Cloudflare releases more details about its larger internal system.
Glossary
- coding agent
- An AI helper that can read, write, and test computer code on its own.
- skill
- A set of written instructions that teaches a coding agent how to do one kind of job.
- findings.json
- A file that stores the audit results in a structured format that computer programs can read.
- schema
- A fixed set of rules that says what data must look like in a file.
- verifier
- An agent that checks whether a claimed problem is real, or tries to disprove it.
- Cloudflare
- A company that provides internet security, speed, and cloud services for websites and apps.