Six-phase source code audit with independent agent validation and structured findings
Published by Cloudflare, this skill turns a coding agent into a six-phase security auditor. The first phase is discovery, where it produces an architectural summary and a coverage ledger. Next comes coverage-driven vulnerability hunting. During validation, a separate agent with no access to the prior conversation tries to disprove each candidate finding. The remaining phases produce a machine-readable findings.json, validate the records, and write the report. Only findings that the independent agent cannot disprove make it into the report. Rejected candidates remain in the coverage ledger, so future runs don’t investigate the same path from scratch.
The output format is defined by a JSON schema. Two dependency-free validators check the output. Penligent’s October 19, 2026 review tested these validators with synthetic examples. The review makes no claims about model benchmarks. It emphasizes that the tool is not Cloudflare’s company-wide scanning system, but only a starting point derived from it, and that it examines source code only. The repository, opened in June 2026, has reached 56,000 stars.
Developers and security teams with access to their own source code who want to investigate a concrete question—such as authorization, data flow, or tenant isolation—with an evidence trail.
It examines source code only; it cannot provide evidence about deployments, identity configuration, or live systems. The multi-agent phases can take a long time and quickly consume model usage limits. The last push was on September 14, 2026, and there is no release tag. Run it only on repositories you are authorized to audit.
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit