security-audit-skill
A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings
What is it?
What it is
A coding-agent skill that turns an agent into a security auditor by orchestrating multiple parallel agents through a six-phase pipeline (recon, hunting, validation, reporting, structured output, independent verification) to find exploitable vulnerabilities with real impact.
Why it exists
It was created to seed Cloudflare's vulnerability discovery harness, providing a reusable, single-repo starting point for automated security auditing that discovers real‑impact flaws and reduces false positives via adversarial validation.
Who should use it
security engineersdevelopersDevOps engineerssecurity researchersAI agent power users
Who should avoid it
non-technical stakeholdersbeginners without security backgroundusers lacking a coding agent or Node.js environment
How it works
A quick walkthrough in plain English
How security-audit-skill works
Step 1 of 3
You interact with it
Open security-audit-skill, send a request, or connect it to your stack.
Features
Advantages
- Focuses on exploitable vulnerabilities with concrete attack scenarios
- Reduces false positives via adversarial review
- Severity based on likelihood × impact, not just checklist deviations
- Multiple runs increase coverage and find more vulnerabilities over time
- Structured output enables integration with other tools and dashboards
- Easy installation and usage through Skills CLI
- Works with any coding agent that supports tool use and parallel sub-agents
- Zero-dependency validator simplifies deployment
- MIT license allows permissive reuse
- Extensive documentation and prompt files for various target types
Disadvantages
- Requires a coding agent capable of tool use and parallel sub-agents (may limit compatibility with simpler agents)
- Node.js required for validation step (adds dependency)
- Can be resource-intensive due to many parallel agents
- Initial setup and understanding of the six-phase process may be complex for newcomers
- Output volume can be high, requiring time to review findings
- Primarily geared toward web/application codebases; binary/kernel hunting requires additional prompt files
- Effectiveness depends on quality of underlying language model and prompts
Installation
native
npx skills add https://github.com/cloudflare/security-audit-skill \ --skill security-audit
FAQ
What does the security-audit skill do?
It runs a six‑phase pipeline (recon, hunt, validation, reporting, structured output, independent verification) that orchestrates parallel agents to find exploitable vulnerabilities, producing architecture.md, REPORT.md, FINDINGS-DETAIL.md, findings.json and validating them against a schema.
How do I install the skill?
Use the Skills CLI: `npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit`. Add `--global` for a user‑level installation.
How do I trigger a security audit with my coding agent?
Start your agent in (or pointed at) the target codebase and ask it to "security audit this codebase", "find security vulnerabilities in ./src", or similar phrases; the skill will prompt for an output directory (defaulting to `~/security-audit-skill/<repo-name>/run-<N>`).
What are the requirements to run the skill?
You need a coding agent that supports tool use and parallel sub‑agents, and Node.js (to run the `validate-findings.cjs` validator in Phase 5).
What design principles guide the audit?
Only report exploitable findings with concrete attack scenarios, use adversarial validation (different agent disproves findings), base severity on likelihood × impact, treat missing defense‑in‑depth layers as hardening notes, and know that multiple runs are additive and increase coverage.
Can I run the skill multiple times against the same repository?
Yes. Each run explores different code paths; the skill reads existing `findings.json` files to skip known issues and target gaps, making multiple runs additive for broader vulnerability coverage.
Featured in Videos
YouTube tutorials and walkthroughs for security-audit-skill
Alternatives
Similar projects ranked by category, topics, and text overlap.
