Last updated: 11/7/2026Last verified: 2026-11-07
<p>Security Audit Skill is Cloudflare''s free MIT-licensed coding-agent skill for multi-phase security audits: reconnaissance, coverage-led hunting, adversarial candidate validation, and machine-readable findings.json output verified by independent fresh agents.</p><ul><li>Six-phase audit flow: reconnaissance, coverage-led hunting, candidate validation, structured output, and independent record verification</li><li>confirmed / needs_validation / rejected verdicts validated against report-schema.json with zero-dependency validators</li><li>Multi-run additive audits reuse prior ledgers and findings to target coverage gaps and revalidate changed source</li><li>Attack-class reference files for memory safety, supply chain, cloud, protocols, client-side, and LLM-related targets</li></ul>
Details
Platform
Features
- Six-phase audit flow: reconnaissance, coverage-led hunting, candidate validation, structured output, and independent record verification
- confirmed / needs_validation / rejected verdicts validated against report-schema.json with zero-dependency validators
- Multi-run additive audits reuse prior ledgers and findings to target coverage gaps and revalidate changed source
- Attack-class reference files for memory safety, supply chain, cloud, protocols, client-side, and LLM-related targets
Languages
Best for
Known limitations
- Needs a coding agent with tool use and parallel sub-agents, plus Node.js for the validators
- Target-controlled builds and dynamic checks require an OS-enforced sandbox with disabled external networking
- Single-run audits catch roughly half the vulnerabilities that repeated runs find, per Cloudflare's test runs
- Runs your agent models under your own plan; not a turnkey scanning product
