security-audit-skill

security-audit-skill is an open-source agent skill from Cloudflare that turns a coding agent (Claude Code, Codex and others) into a multi-phase security auditor.

It runs recon, vulnerability hunting and adversarial validation: every candidate finding is handed to a fresh agent that tries to disprove it, and only findings that survive are reported, in a machine-readable format. Cloudflare says the skill seeded its internal fleet-wide vulnerability harness.

Signals this window:

• #1 on GitHub daily trending on 2026-11-07 (about +2,548 stars that day, ~64.8k total);
• License: MIT;
• Repo: https://github.com/cloudflare/security-audit-skill

Why it matters

AI agents now write a lot of code fast, but reviewing it for security lags behind. The key idea here is separation: the agent that verifies a finding is never the one that found it, which cuts false positives that plague LLM security scans.

Limits

• Audits run long and users report heavy token usage;
• Findings are still suspected issues to confirm, not a security guarantee;
• Don't confuse it with other repos of the same name (for example netresearch/security-audit-skill).

1. Install it into your agent with the skills CLI, e.g. npx skills add cloudflare/security-audit-skill (check the repo README for the current command);
2. Confirm the agent lists the skill (for example via skills list);
3. In your project, ask the agent to run a security audit with the skill;
4. Review the verified, machine-readable findings and fix or triage each one;
5. Budget for tokens: run it on focused directories first.