The Cloudflare security audit skill is a free, MIT licensed Agent Skill that turns a coding agent such as Claude Code or Codex into a structured security auditor for a codebase you own. You install it with one npx skills add command, then ask your agent to "security audit this codebase". The agent maps the code, sends separate subagents to hunt for bugs, has fresh subagents try to disprove every candidate, and writes the survivors to a schema checked findings.json plus a readable report.
It is the top repository on GitHub's daily trending list this morning, with 2,271 new stars in a day and about 42,900 in total when we checked at 7:45 AM ET on October 24. Below is what it does, how to install and run it, what we tested, and where its limits are.
What the Cloudflare security audit skill is
Cloudflare published cloudflare/security-audit-skill on June 18, 2026, alongside its engineering post Build your own vulnerability harness. The post explains that the company started with a roughly 450 line skill run against one repository, tuned the prompts until they surfaced real bugs, and then lifted each phase into its own agent with a database and an orchestrator. That bigger system, which Cloudflare says took about six weeks to grow into a scanner covering 128 repositories, is not in the repo. What you get is the single repository starting point. Cloudflare says the published version was cleaned up but remains substantially the same, and the workflow and validators were reworked in a September 10 commit.
If skills are new to you, our Agent Skills guide covers the SKILL.md format and where each agent looks for skills. For lighter skills aimed at interface work, see the best design skills for Claude Code. This one is large: a main SKILL.md, phase files for reconnaissance, hunting and validation, a core attack class file and ten domain companions. The companions cover areas such as memory safety, web protocols and authentication, client side code, supply chain and release, cloud deployment, tenant isolation and an AI and LLM file for prompt injection, agent tools and MCP trust. It also ships two Node.js validators with no dependencies and their test suites.
How the six phases work
The skill has two modes. Guidance mode is the default: ask a security question or request a focused review and the agent uses only the relevant parts, without creating files. Full audit mode runs only when you explicitly ask for an audit, a pen test, a full or end to end review, or report files. If your request could mean either, the skill tells the agent to ask you one question first.
A full audit runs these phases in order:
| Phase | What happens | Output |
|---|---|---|
| 1. Reconnaissance | Agents map architecture, trust boundaries and input surfaces | architecture.md, coverage-ledger.json |
| 2. Hunting | Isolated hunter subagents work through ledger units; coverage critics look for gaps | Structured candidate results |
| 3. Candidate validation | A fresh verifier, never the finder, tries to disprove each candidate | Surviving candidates |
| 4. Structured output | Records written and checked by validate-findings.cjs | findings.json |
| 5. Record verification | New agents recheck the final source claims | Corrected records |
| 6. Reporting | Reports derived from the verified records | REPORT.md, FINDINGS-DETAIL.md, NEEDS-VALIDATION.md |
Every record gets one of three verdicts. confirmed needs a complete source trace and an observed result. needs_validation means the path is visible in source but one exact fact (often a deployment setting) is unknown, and it carries no severity. rejected records a candidate that was disproved. Only confirmed findings get a severity, from informational to critical, and the skill ties each level to demonstrated impact rather than a checklist. The skill describes fixes but never edits the target source.
How to install it for Claude Code, Codex and other agents
You need Node.js. The README installs through the Skills CLI:
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-auditAdd --global to install it for your user instead of one project. We ran the install on our test machine with Skills CLI 1.5.18, targeting two agents:
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit -a claude-code -a codex -yIt copied the files into .agents/skills/security-audit, which Codex reads directly, and created .claude/skills/security-audit as a symlink for Claude Code. It also wrote a skills-lock.json recording the source repo and a content hash, so teammates get the same version. Before installing, the CLI printed third party risk ratings for the skill (Gen: Safe, Socket: 0 alerts, Snyk: Med Risk) and closed with a reminder that skills run with full agent permissions. Read the files before you use them, as you would with any skill.
Cursor, Gemini CLI and VS Code with Copilot also read .agents/skills/, per the folder table in our skills guide. The README's requirement is a coding agent whose model supports tool use and parallel subagents. Claude Code subagents run in their own context windows, and current Codex releases enable subagent workflows by default in the app, CLI and IDE extension.
Running a Claude Code security audit with the skill
Start your agent in the repository and ask in plain words. The README's examples are "security audit this codebase", "find security vulnerabilities in ./src" and "do a security review, output to ~/audits/my-project". Output goes outside the target by default, to ~/security-audit-skill/<repo-name>/run-<N>. It writes inside the repo only if you pick a folder that version control ignores.
Three controls are worth setting in the prompt:
- Profile.
quickruns one hunter wave and one critic pass and is meant for small targets or a first look.standardis the default.deepsplits work per subsystem and keeps critic waves going until a clean pass. - Scope. You can limit a run to named paths, one subsystem or the diff between two commits. Everything else is marked out of scope, never covered.
- Budget. You can cap the total number of agent invocations. The skill reserves calls for reconnaissance, critics and verifiers before it spends anything on hunters, and if the cap cannot fund that minimum it stops and asks.
That budget control matters because this is expensive by design. OpenAI notes that subagent workflows consume more tokens than single agent runs, and Anthropic says each Claude Code subagent counts toward the same usage limits as your main conversation. Start with a quick, scoped run.
Runs are additive. A second run reads the earlier ledger and findings, rechecks changed code and targets the gaps. Cloudflare says a single run found roughly half of the vulnerabilities that repeated runs found in total, so plan on more than one pass.
The sandbox requirement most people skip
The skill reads source freely, but it will only build, test or run target code inside an OS enforced sandbox with four controls: no external network, an empty environment filled from an allowlist, a read only target that can write only to its own scratch folder, and limits on CPU, memory, processes, file size, disk and wall clock time. If any control is missing, the agent should not execute target code and the finding stays needs_validation, with the missing capability recorded as the blocker.
Do not assume your agent's built in sandbox qualifies. Claude Code's Bash sandbox blocks direct network access, but by default it inherits Claude Code's environment variables, can read most of the machine including ~/.ssh, and does not cover file tools, MCP servers or hooks. You would need to tighten those settings first. Dedicated runtimes such as NVIDIA OpenShell or the hosted sandboxes in our E2B vs Daytona vs Modal comparison are other options; check each control against the skill's list rather than trusting a label.
What we tested
We cloned the repo at its September 14 commit and ran both test suites with Node.js 20: validate-findings.test.cjs passed 34 of 34 tests and validate-coverage-ledger.test.cjs passed 31 of 31. Passing an empty findings array printed PASS: 0 findings valid. A record holding only a verdict and title failed with exit code 1 and a list of missing fields such as fingerprint, root_cause, trace and evidence. That strictness is the point: an agent cannot hand over a vague prose finding and call it done.
We did not run a full audit against a codebase. That needs a signed in agent session, real model spend and a qualifying sandbox, so we make no claims here about how many bugs it finds or how long a run takes.
How it compares with Claude Code's /security-review
Claude Code ships a /security-review command that checks the diff between your branch and the default branch for risks such as injection, authentication problems and data exposure. It is quick and suits a check before a merge, alongside the tools in our Claude Code Review guide. The Cloudflare skill aims at the whole repository: a coverage ledger, independent disproof of each candidate and machine readable records you can track across runs. Use the command per change and the skill for periodic sweeps, which matches Cloudflare's own advice that big scans are a backlog sweep, not a check on every pull request.
Limits and cautions
- Audit only code you own or have written permission to test. The skill forbids probing deployed endpoints, production identities and shared services, but your agent's permissions still apply.
- It is not Cloudflare's harness. The post lists what a single session lacked: context fills up on long runs, a crash means starting over, and one repo session cannot see bugs between repositories. If you find yourself running it ten times and diffing by hand, the post says it is time for a real agent harness.
- Open issues exist. On October 23 a user filed an issue reporting that a target controlled repository name can drive the output path and prior run reuse. Check the issue tracker before pointing it at untrusted code.
- Findings are leads until confirmed. Treat
needs_validationitems as a to do list for a human, not as vulnerabilities.
FAQ
Is the Cloudflare security audit skill free?
Yes. The skill is MIT licensed and costs nothing. You pay only for the model usage of the agent that runs it, which can be large because the workflow spawns many subagents.
Does the security audit skill work with Codex?
Yes. The skill is written to be agent neutral, and the Skills CLI installs it into .agents/skills/, which Codex reads. Codex enables subagent workflows by default in current releases, which the skill needs.
Will the skill fix the vulnerabilities it finds?
No. It recommends the smallest effective source fix for each confirmed finding and suggests regression tests, but it does not modify the target code. You or your agent apply fixes in a separate step.
Is this the same system Cloudflare uses internally?
No. It is the skill that seeded Cloudflare's vulnerability discovery harness. The harness adds a database, an orchestrator, deduplication, cross repository tracing and a separate validation system running on a different model. Cloudflare said it hoped to release the harness later.
How do I uninstall the skill?
Run npx skills remove security-audit -y. In our test it deleted both the .agents/skills/ folder and the .claude/skills/ link but left the entry in skills-lock.json, so remove that by hand if you commit the lock file.
