Cloudflare Releases Open-Source Skill to Transform Coding Agents into Security Auditors

Cloudflare has released security-audit-skill on GitHub, presenting a workflow that transforms AI coding agents into professional security auditors. This skill orchestrates isolated agents to automate the process from reconnaissance to verification.

6-Step Audit Process

This skill performs security audits using the following 6-step structure.

• Reconnaissance: Maps architecture, trust boundaries, input surfaces, etc., to generate architecture.md and coverage-ledger.json.
• Coverage-based exploration: Assigns isolated hunter agents per ledger unit and explores missing parts through coverage critics.
• Candidate verification: Passes all unique candidates to new verifiers to attempt refutation.
• Structured output: Records confirmed, needs_validation, and rejected records in findings.json and validates them against a schema.
• Independent record verification: New agents verify final source claims, using additional independent verifiers for significant changes.
• Target-neutral reporting: Generates REPORT.md and other outputs based on verified records and coverage ledgers.

Technical Requirements and Features

• Validation scripts: Validates ledgers and findings using validate-coverage-ledger.cjs and validate-findings.cjs.
• Sandbox required: Requires an OS-level sandbox with external network blocking, resource limits, and write access restricted to allowed paths. Without these controls, target code is not executed and remains in the needs_validation state.
• Installation and usage: Install with the npx skills add command; it activates automatically when a security audit is requested.