Security Audit
Cloudflare's multi-phase vulnerability hunt, with every finding checked by a fresh agent that tries to disprove it
About
Turns your coding agent into a security auditor that runs six phases: reconnaissance (architecture, trust boundaries, input surfaces), coverage-led hunting with isolated hunter agents, validation where a fresh verifier tries to disprove each candidate, structured output in findings.json checked against a schema, independent re-verification of source claims, and a final REPORT.md. Findings end up confirmed, needs_validation or rejected. Attack class guides cover web and auth, LLM and agent tools, supply chain, cloud, memory safety, client side and more. It is the skill that seeded Cloudflare's internal vulnerability discovery harness, and repeat runs build on earlier ledgers to target gaps.
Install
Works with Claude Code, Codex, Cursor, OpenCode, Gemini CLI
Access
MediumWhat this skill's own files let it touch on your machine and accounts. Access isn't a verdict: check the publisher and the security audits too.
- Bundles scripts
- Runs shell commands
- Writes files in your project
- No network access
- No credentials needed
Mostly prompt files. It bundles two small zero-dependency Node validators (validate-findings.cjs and validate-coverage-ledger.cjs) that the agent runs to check its JSON output, and it writes audit files (architecture.md, coverage-ledger.json, findings.json, reports) into your repo. It spawns several sub-agents, so a full audit can use a lot of tokens. Run it on code you own or are allowed to test.
Reviewed from source on Oct 22, 2026. Read the files yourself before installing.
More Security skills
All skillsRelated articles
All articles
AI Agent Sandboxes Compared (2026)
I compare E2B, Perplexity SPACE, NVIDIA OpenShell, Anthropic srt and Kernel on isolation, pricing, free tiers, MCP support and real install commands.
Best Memory Tools for Claude Code (2026)
Five tools that give Claude Code memory across sessions, agents and machines, with install commands, honest caveats and when CLAUDE.md is enough.
7 Tools to Cut Your Coding Agent's Token Bill (2026)
Seven tools that cut Claude Code, Codex and Cursor token usage by compressing shell output, searching code and fetching current docs, with honest caveats.