Cloudflare open-sources an AI security audit skill

Cloudflare has lifted the lid on its internal vulnerability-discovery harness and open-sourced security-audit-skill: a set of skills that turns a coding agent (Claude Code, Copilot and friends) into a structured security auditor.

Key takeaways

Cloudflare has released security-audit-skill under the MIT license, a set of skills that turns a coding agent able to call tools and run parallel sub-agents into a security auditor. The workflow has six phases, from architecture reconnaissance to the final report. Its core principle: the agent that finds a vulnerability never validates it itself, and a fresh agent tries to refute it. Results are sorted into "confirmed", "needs_validation" or "rejected", and a finding without exact proof stays unrated. The skill works with agents such as Claude Code or Copilot, and Cloudflare's own harness is the origin of the approach. Cloudflare described the approach in a blog post published on June 18, 2026, where its internal harness produced 20,799 candidates, of which 12,057 survived validation. For teams that ship code, the lesson is less about the model than about process discipline: traced coverage, independent validation and proof required before any severity is assigned.

What is security-audit-skill?

A skill is a set of instructions that a coding agent loads to perform a specific task, here a security audit. security-audit-skill is triggered by a plain sentence, for example "security audit this codebase", and requires an agent whose model supports tool use and parallel sub-agents.

What are the six audit phases?

The GitHub repository describes the workflow in six phases.

Phase	What it does
1. Reconnaissance	Maps architecture, trust boundaries, input surfaces and prior evidence
2. Coverage-led hunting	Assigns coverage-ledger units to isolated hunters, then coverage critics look for gaps
3. Candidate validation	Gives every unique candidate to a fresh verifier that tries to disprove it
4. Structured output	Writes confirmed, needs_validation and rejected records to findings.json
5. Independent verification	Fresh agents check the final claims against source; a material replacement gets another verifier
6. Reporting	Produces REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md

Why separate discovery from validation?

Cloudflare made a smart call: the agent that finds a finding never validates it itself. A second, clean agent receives the discovery with a single mission: refute it. The statuses follow from that test. "confirmed" requires a complete source trace with a bounded observed result. "needs_validation" names an exact unresolved fact, with no severity assigned. "rejected" documents a disproved candidate.

The attack classes covered go far: supply chain and CI/CD, IAM and InfraAsCode, containers, serverless, prompt injection on targets embedding an LLM, resource exhaustion. The repository's list extends to tenant isolation, webhooks and memory safety.

What problem does it solve: audit hallucination?

AI-driven security audits suffer a known problem: the model hallucinates vulnerabilities or misses half of them, and nobody knows which. Here, coverage is tracked in a ledger, runs are additive (the skill reuses previous audits to target the gaps) and every final claim passes through an independent agent. On projects already reviewed manually, the Cloudflare set surfaced findings that had been missed.

Cloudflare's blog post on its harness, by Grant Bourzikas, gives orders of magnitude for the internal version: 20,799 candidates generated, 12,057 surviving validation. The initial rejection rate dropped from 40% to 11%. Agents invoked Semgrep zero times in one month, which suggests models prefer dynamic code analysis. These figures concern the internal harness, not the published skill.

Will an agent-driven audit become a standard CI step?

Tools like this are likely to become a standard step in CI pipelines within two years, just like SAST and DAST: a skill-based audit between lint and tests, on every merge.

Still, a tool doesn't do everything. Cloudflare says it themselves on their blog: the skill grew to run at the scale of their fleet, but their real asset is process discipline rather than the model under the hood.

What it changes for your teams

An audit harness open to everyone: the question is no longer whether your agents will audit your code, but when. For us, who design, secure and operate production platforms, the value is being able to reproduce the discipline rather than take a model at its word. The same control logic applies to agents themselves, as in the case of ghost agents and RSA Agent ID, and the supply chain remains a central attack class, as the malicious packages on RubyGems episode shows.

Measures we apply:

1. Start with an audit on a repository already reviewed by hand, to measure what the agent rediscovers and what it adds.
2. Treat every "needs_validation" finding as a human task, with no severity until the missing fact is established.
3. Require replayable proof before any ticket: source trace and observed result.
4. Run the audit agent with read-only access to the repository and no access to production secrets.
5. Keep the coverage ledger and reports as pipeline artifacts, so each run starts from the previous ones.