Cloudflare open-sourced the skill behind its AI vulnerability hunter — and the clever bit isn’t the AI, it’s the referee
Ask an AI to review your code and it will find things. Some of them will be real. Some of them will be confident nonsense. The difference between a useful audit and a pile of false alarms is verification — and that is the whole idea behind cloudflare/security-audit-skill, the repo sitting at number two on GitHub Trending today with 2,088 new stars in a single day and 64,874 stars in total.
This is not a scanner you run and get a report from. It is a skill: a set of prompts, rules, and validators that turns your coding agent into a security auditor — and then makes a different agent try to disprove everything the first one found. The agent that checks a finding is never the agent that found it. That one rule, borrowed from how human audit teams work, is what makes the whole thing worth your time.
Where it came from
The skill is the starting point of Cloudflare’s own internal vulnerability discovery harness, described in the company’s June 18, 2026 blog post “Build your own vulnerability harness.” Engineers took a roughly 450-line skill, ran it against a single repo, tuned it until it surfaced real bugs, and grew it into a fleet-wide system. The numbers from that internal system are striking: 128 repos covered in about six weeks, 20,799 raw candidates narrowed to 7,245 actionable findings sent to engineering teams, and a validation rejection rate that fell from 40 percent to 11 percent as the recon context improved.
Keep the attribution straight, though: those numbers belong to Cloudflare’s internal fleet system, not to this open-source skill. The repo is the single-repo starting point the harness grew from — a small, focused project with just 14 commits, a README, a license, and a skills folder. It is MIT-licensed, maintained by Cloudflare itself, and it was created on June 18, 2026, the same day as the blog post. What you are downloading is the seed, not the fleet.
How the six phases actually work
The skill runs a full audit in six phases, and the structure is the product:
- Reconnaissance — the agent maps your architecture, trust boundaries, input surfaces, and prior evidence into an architecture document and a coverage ledger.
- Coverage-led hunting — isolated “hunter” agents are assigned from the ledger, one per attack class, while coverage critics hunt for gaps in the plan itself.
- Candidate validation — every unique candidate goes to a fresh verifier agent that tries to disprove it. This is the referee step, and it is the whole point.
- Structured output — findings land in a machine-readable findings.json with three verdicts — confirmed, needs_validation, rejected — validated against a schema by zero-dependency Node validators.
- Independent record verification — fresh agents re-verify the final source claims, and any material replacement gets another independent verifier.
- Target-neutral reporting — human-readable reports are derived from the verified records, not written freehand by the agent that found the bugs.
The attack coverage is unusually broad, with a dedicated prompt file per domain: core and wildcard attack classes, memory safety and binary/kernel issues, AI and LLM risks including prompt injection, web protocol and auth, client-side and DOM issues, supply chain and release security, cloud and deployment, protocols and messaging, resource exhaustion, data isolation and lifecycle, and desktop, mobile, and local IPC. It audits codebases, APIs, services, CLI tools, libraries, and daemons — any source repo you point it at. Multiple runs against the same repo are additive: later runs target the gaps and revalidate changed code rather than starting over.
Install it with one command
Installation uses the Skills CLI:
npx skills add https://github.com/cloudflare/security-audit-skill \
--skill security-auditAdd --global for a user-level install. Then start your coding agent in — or pointed at — the codebase and ask in plain language: “security audit this codebase,” “find security vulnerabilities in ./src,” or “do a security review, output to ~/audits/my-project.” The skill activates automatically when the request matches its trigger, which includes phrases like security audit, find vulnerabilities, and pen-test the code.
There are two modes. Guidance mode handles security questions and focused reviews without creating files or running the full workflow. Full audit mode, triggered by an explicit audit or pen-test request, runs all six phases and writes artifacts — by default to a folder outside the target repo, under ~/security-audit-skill/<repo-name>/run-<N>. Run profiles let you pick the depth: quick for a bounded first look, standard as the default, and deep for high-stakes or large targets. You can also scope a run to part of a codebase.
One thing the README does not do is name a specific product. The skill is explicitly agent-neutral: it requires a coding agent with a model that supports tool use and parallel sub-agents, and its instructions use platform-neutral terms. In practice that means tools like Claude Code and Codex, but that compatibility is inferred from the requirement, not stated by Cloudflare — so treat it as “any capable coding agent” rather than an officially supported list.
What it costs, and the honest limits
The skill itself is free. MIT license, no Cloudflare account needed, no API keys in the README. The real cost is your coding agent’s model usage, and Cloudflare is candid that fleet-scale scanning “is not cheap”: a full scan of a complex repo can take hours, with the worst run they report taking just over 14 hours. The skill has a built-in cost-budget feature that records the maximum agent invocations in its run metadata, so you can cap a run before it eats your token budget. One user report on Hacker News mentioned spending roughly a million tokens on a medium codebase with nothing to show for it — a single anecdote, not a measured figure, but a useful warning about what an unbounded deep run can cost.
The limits matter more than the cost. Cloudflare says explicitly that one run finds only about half the bugs repeated runs find, and that findings “skewed toward the simpler and less subtle.” This is a repeatable process, not a checkbox. The company also claims no false-negative rate at all — in its own words, “any claimed recall number is entirely speculative” — so a clean report does not mean a clean codebase. And in Cloudflare’s own pipeline, the auto-fixer never merges code on its own; a human reviews the branch. Findings are leads with evidence, not verdicts, which is exactly why the needs_validation category exists.
There is one setup requirement worth knowing before you start: anything target-controlled — builds, tests, fuzzers, browsers — must run in an OS-enforced sandbox with no external network, a sanitized allowlisted environment, resource limits, and writes only to assigned scratch paths. Without those controls, the workflow simply refuses to execute target code and records the lead as needs_validation instead. That is the safe default, but it means the skill proves less on a machine where you have not done the sandbox setup.
Who should try it
If you maintain an open-source project, run a small team without a dedicated security reviewer, or just want a second pair of eyes on a codebase before a release, this is one of the most practical things to come out of the agent-skills wave. It is free, it installs in one command, and its design — hunters find, referees disprove, nothing ships without a source trace and a working proof-of-concept — is a genuine improvement over asking a chatbot to “check my code for vulnerabilities.”
Just go in with the right expectations. Run it more than once. Budget the tokens. Read the findings yourself. And remember what Cloudflare itself says: the skill is the starting point, and a clean report is the beginning of an audit, not the end of one.
Also today: Tesla is winding down Cybertruck production by mid-2027 and Steam free games November 2026 — Payday 3 and Age of Wonders 4 free this weekend. For more on the agent-skills wave, see our Google Skills coverage, Meta Muse Spark Open, and Claude Duet.