security-audit-skill: AI-Powered Security Audit Skill Released by Cloudflare

This skill transforms coding agents into security auditors. It distills the core logic Cloudflare used to build its own vulnerability detection harness, tailored for single-repository scale. A structured six-stage workflow, from reconnaissance to reporting, automates architecture mapping and vulnerability verification.

Discovered vulnerabilities undergo Adversarial validation, where an independent verification agent re-checks them. This reduces false positives and produces a machine-readable findings.json file with clear classifications: confirmed, needs_validation, and rejected. Dedicated prompts are included for various attack classes, including Web, Cloud, AI/LLM, and Supply Chain.

Considering that coverage improves with repeated runs rather than a single execution, the system focuses on unverified areas based on previous results. It includes Node.js-based zero-dependency verification scripts to maintain the integrity of findings and the coverage ledger without complex dependencies. Provided under the MIT license, it operates in coding agent environments that support tool use and parallel sub-agents.