Cloudflare has published the security-audit-skill, a framework that turns coding agents into security auditors through a structured six-phase workflow. The skill originated from Cloudflare’s internal vulnerability discovery harness and now serves as its single-repo starting point.
The workflow runs reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. Hunting modules cover memory safety, AI/LLM targets, web protocols, client-side vulnerabilities, supply chain, cloud deployment, RPC/messaging, resource exhaustion, data isolation, and desktop/mobile IPC.
Installation uses the Skills CLI: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit. Requirements include a coding agent with tool use and parallel sub-agent support, Node.js for validators, and an OS-enforced sandbox for target-controlled builds.
Findings are written to machine-readable JSON validated against a schema. Independent verification agents re-check factual claims before marking findings as confirmed, needs_validation, or rejected.