Cloudflare releases security-audit-skill: the skill that turns your coding agent into a security auditor (+3,000 stars in one day)

Cloudflare releases security-audit-skill: the skill that turns your coding agent into a security auditor (+3,000 stars in one day)

🔎 Security auditing becomes a terminal command

On Friday, September 19, 2026, the cloudflare/security-audit-skill repo racked up around 3,006 GitHub stars in a single day. That's nearly a quarter of its 13,673 total stars, three months after its release on June 18. A security repo blowing up three months after launch isn't a marketing stunt: it was an independent benchmark that lit the fuse.

The principle fits in one sentence. You type "security audit this codebase" into your coding agent, and it turns into a security auditor: codebase reconnaissance, vulnerability hunting carried out by parallel agents, adversarial validation of each candidate, structured report, independent verification. MIT license, zero installation, zero dependencies.

Why now? Because agents write more code every day — and nobody audits it at the same speed. Meanwhile, GreyNoise documents the first worldwide campaign of agent-generated exploits. Security auditing is becoming a terminal command. On both sides of the fence.

Key takeaways

• Cloudflare open-sources the skill that seeded its internal harness: ~450 lines originally, a six-phase pipeline, MIT license, activation in a single sentence.
• The internal harness's numbers give a sense of scale: 128 repos covered, 20,799 raw findings, 12,057 automatically validated, 7,245 sent to teams as actionable (Cloudflare blog, 2026).
• Independent blind test (September 19, 2026): median precision of 90%, zero hits on planted decoys — but $29.95 per run versus $2.06 for a single-agent with identical recall.
• A single run only finds half: the real method is additive multi-runs, where each pass reads the previous findings and targets coverage gaps.
• The model matters more than anything: at the lowest tier, recall drops from 47% to 27%.

Recommended tools

The skill itself is free. What costs money is the inference of the agents that run it — and the host agent you choose.

Real cost of an audit: a median $29.95 per run for the "quick" profile measured in the September 19 blind test — to be multiplied by the number of runs (see below). For a broader comparison, our selection of the best AI coding tools is continuously updated.

A skill, not a product: what the repo actually contains

It's neither a SaaS, nor a scanner, nor an extension: it's a folder of markdown files and scripts that your agent reads and executes. It's this format that explains both its virality and its limitations.

The repo grew out of a skill of roughly 450 lines, recounts Grant Bourzikas, Cloudflare's CSO, in "Build your own vulnerability harness". The public version is more extensive: an orchestration SKILL.md, methodology files per attack class (RECONNAISSANCE.md, HUNTING.md, ATTACK-CLASSES.md, WEB-PROTOCOL-AND-AUTH.md, CLIENT-SIDE.md, MEMORY-SAFETY-AND-BINARY.md, and an AI-AND-LLM.md dedicated to flaws in AI code itself), plus two zero-dependency scripts: validate-findings.cjs, which checks that the output JSON conforms to the schema, and validate-coverage-ledger.cjs, which audits the coverage ledger.

Three phrases are enough to trigger an audit: "security audit this codebase", "find security vulnerabilities in ./src", or "do a security review, output to ~/audits/my-project". No configuration, no dedicated API key — the skill lives inside your agent, not alongside it.

My take: the value isn't in the code, which amounts to a few hundred lines. It's in the encoded methodology — attack classes, anti-patterns, attacker scenarios — in other words, years of security review practice condensed into machine-readable markdown.

Three output artifacts

Each audit produces three files. A human-readable REPORT.md. A FINDINGS-DETAIL.md that traces each MEDIUM+ vulnerability from input to sink, with file:line references. And a machine-readable findings.json, compliant with report-schema.json and validated by script — designed to feed your tickets, your CI, or a dashboard, not to end up in a PDF.

It's this triad that sets the skill apart from the usual "AI reviews": findings independently verified and actionable, directly aimed at countering the false positives of automated code reviews.

Six phases, one principle: the one who validates never found it

The public six-phase pipeline — reconnaissance, hunting, validation, reporting, structured output, independent verification — rests on a single principle: the agent that verifies a finding is never the one that found it. Everything else follows from that.

During the hunting phase, the skill launches 3-4 agents in parallel for a small library, 8-12 or more for a large application — split both by attack class and by subsystem. The scopes deliberately overlap: duplicates are better than gaps. These hunting agents are "general" agents capable of spawning their own sub-agents when a rabbit hole warrants deeper investigation.

The README's cardinal rule: "Only report what you can exploit". Every finding requires a concrete attack scenario — exact inputs, requests, sequence of actions. No "an attacker could theoretically". A reproduced result beats an argument.

Adversarial validation, the centerpiece

Then comes validation, and that's where the skill sets itself apart. Duplicates are consolidated before validation, then each remaining finding is handed to a separate validation agent whose only job is to refute it. Hunters are biased toward discovery; validators, toward eliminating false positives. The conflict is organized, not endured.

Severity is calculated as likelihood × impact — not as deviation from a checklist. And a clear-cut distinction: a defense-in-depth gap is not a vulnerability. If layer A blocks the attack, the absence of layer B is a hardening note, not a finding.

Final phase: one fresh agent per confirmed finding, all in parallel, re-verifies every claim in the JSON against the actual source code. This isn't LLM paraphrasing — it's a chain of accountability.

Coverage-guided hunting

An underrated detail: every run is additive. The skill reads the findings.json files from previous audits to skip known issues and target coverage gaps. A coverage ledger, validated by a zero-dependency script, tracks what was searched, where, and by whom. This isn't one-shot: it's cumulative coverage, like a pentester keeping their notebook.

The genesis: 450 lines of skill, six weeks, 128 repos

The public skill is the embryo of a far larger internal system — and Cloudflare documented the genesis with rare candor. It all started with a skill of roughly 450 lines running on a single repo, with prompts that stayed almost unchanged: attacker scenarios, bug classes, anti-patterns.

Six weeks later, the full harness covers 128 distinct repos — a mix of Rust, Go, C, Lua, TypeScript and Python — built on a two-tier architecture: a Vulnerability Discovery Harness (VDH) that hunts, and a Vulnerability Validation System (VVS) that validates. The internal loop runs in seven stages — Recon, Hunt, Validate, Gapfill, Dedup, Trace, Feedback — closed out by a report generated by pure script, no model involved. A telling detail: depending on the model used, the "sibling" agents end up absorbing 9 to 20% of fleet-wide tasks. The harness is spilling beyond its original scope, and they own it.

Two architectural choices deserve highlighting. First, a different model for discovery and for validation: model B judges model A's outputs as an impartial adversary, and providers are treated as interchangeable commodities — you swap providers the way you swap batteries. Second, persistence: a single SQLite database, keyed by (run_id, repo, stage). Not throwing away a 5-hour run over a single error turned out to be more critical than parallelism itself.

The funnel that eliminates 65% of findings

The figures reported by The Terminal give a sense of the system's scale: 20,799 raw findings generated across 145 internal repos, of which 12,057 survived automated validation, and 7,245 sent to teams as actionable. The VVS currently holds 13,841 findings.

The funnel also improved over time: the rejection rate for weak findings dropped from 40% to 11% at maturity, and the share of findings backed by a check that was actually executed rose from 35% to 58%. On a repo of about 30,000 lines, a standard scan compressed 100 initial findings into 80 distinct bugs in ~14 hours, with automated patches at ~5 minutes each.

My take: the funnel is the real product. Any agent can generate 20,000 "possibly vulnerable." The harness, for its part, knocks out 13,000 of them before a human has to read anything.

Cloudflare's advice for building your own

The post ends with a deliberately minimal recipe: a minimal harness is Recon + Hunt + Validate backed by a database, a separate Validator that can't file its own findings, and no cross-repo tracing until you have several repos that matter. If you want to lay the bricks yourself, our guide on creating an AI agent covers the fundamentals — the rest is discipline.

The September 19 blind test: 90% precision, a price that stings

The September 19 star moment coincides with a pre-recorded blind test that credits the skill with 90% median precision — and a bill roughly 14 times higher than a simple agent. Both numbers are true at the same time, and that's exactly what makes the document interesting.

GitHub user HetCreep filed an issue describing a three-round blind comparison: the skill against its own "multi-lens" pipeline, against a simple single-agent control. Clean protocol: pre-registered tests, scoring by someone who hadn't seen any of the runs, conflict of interest disclosed upfront. Cloudflare had not commented on the issue as of 09/19.

Results lived up to the buzz: 90% median precision for the skill, zero hits on the two planted decoys, every claim confirmed with a trace back to the code. But six gaps are listed, and the first one stings:

In plain terms: at equal model tier, the skill and the single-agent find the same proportion of planted facts. What you're buying with the skill isn't extra coverage — it's precision, traceability, and findings that survive validation. If you just want volume on the cheap, a single-agent is enough. If you want findings you can hand to a team without re-sorting them, the skill earns its keep.

Another gap to know about before you launch anything: on the weakest model tier, the skill's recall drops to 27%, versus 47% for the single-agent. The multi-agent pipeline amplifies what the underlying model can do — including its weaknesses.

A first audit in practice: the agent, the model, the multi-runs

You need three things: a host agent capable of launching parallel sub-agents, a top-tier model, and multi-run discipline. Without any one of the three, you'll measure the skill at its worst version.

Setup-wise, it's a clone and a copy:

git clone https://github.com/cloudflare/security-audit-skill.git
# copy skills/security-audit into your agent's skills folder
# (Claude Code example: ~/.claude/skills/security-audit)

Then one sentence in your agent's terminal: "security audit this codebase" for a full audit, "find security vulnerabilities in ./src" to target a folder, "do a security review, output to ~/audits/my-project" to force the report's destination.

The model matters more than the number of agents

This is the least glamorous lesson from the blind test: recall collapses on weak models. For the hunting phase, aim for the top-tier agentic models — Claude Opus 4.7, GPT-5.5, Gemini 3 Pro Deep Think — and keep mid-tier models like Claude Sonnet 4.6 for the reporting phases. Our comparison of the best LLMs for coding is the right starting point.

A point often overlooked in a security context: if your codebase is sensitive, self-hosted models like Kimi K2.6 or GLM-5 (Reasoning) let you run the audit without a single line of code leaving your infrastructure. The recall/cost trade-off then needs to be evaluated differently.

A single run only finds half

A figure to remember: a single run only finds about half of the vulnerabilities of a multi-run series. Best practice is to plan 3 to 5 runs on a critical repo, letting the coverage ledger accumulate: each pass skips what's known and attacks the gaps. This is exactly the agent memory problem — our article on AI memory details the persistence patterns that apply here to findings.json.

Which host agent?

The skill relies on launching agents in parallel via the Task tool — so on agents that know how to orchestrate sub-agents. Claude Code is the natural home turf, but OpenCode, the open-source coding agent that gathers 8 million devs and 172,000 GitHub stars, is a credible alternative if you want to stay fully open source end to end.

Static analysis, skill, pentest: who does what

security-audit-skill replaces neither Semgrep and CodeQL, nor human pentesting — it fills the gap between the two. Starlog's technical analysis sums it up well: the skill is a DAG of prompt templates executed sequentially, with each phase launching parallel agent instances on a shared JSON state. And where static analysis finds known patterns (SQLi, XSS, hardcoded credentials) but fails on business logic flaws, the skill hunts precisely what requires contextual understanding.

The right pipeline isn't "either/or": static analysis in CI on every commit, agent audit weekly or at every release, human pentest on critical surfaces. The skill brings the cost of the second link down from a few thousand euros to a few dozen dollars — that's the breakthrough.

And the timing is no coincidence. While auditing becomes a terminal command, attacks are industrializing at the same pace — the campaign documented by GreyNoise is the proof of concept on the offensive side. Governance is catching up: AiUC raises $55M to impose SOC 2 on AI agents, with 5,000 jailbreak tests. Security auditing is becoming a terminal command for everyone — it's up to you to decide whether you type yours before or after.

A signal for the skills ecosystem

Beyond security, the repo validates a format: expert methodology encoded in markdown, zero-dependency scripts, auditable JSON state. It's this format, more than the subject matter, that explains the ranking — the repo was the #1 repo of the day on GitHub (Trendshift, first appearance on 28/06/2026).

The momentum extends beyond this repo. Archify, 14,900 stars in one week, forces AI agents to document their work. Prime Agent, GitHub's #1 repo with 17,500 stars, makes code agents self-improving — and auditable. The pattern is the same everywhere: we're no longer packaging software, we're packaging executable know-how.

My take: the next two years will see fewer "AI tools" and more "skills" — specialist procedures encoded in markdown that any agent can execute. Cloudflare has just written a reference chapter of this, and released it under MIT.

❌ Common Mistakes

Mistake 1: Judging the skill on a single run

A single run finds only about half the vulnerabilities of a multi-run series — concluding after one pass means measuring the skill at its worst. Solution: 3 to 5 runs on critical repos, letting the coverage ledger accumulate passes.

Mistake 2: Skimping on the model

At the lowest tier, recall drops from 47% to 27%: you save a few dollars of inference and lose a fifth of the findings. Solution: top tier for the hunt, a mid-tier model is sufficient for reporting.

Mistake 3: Confusing hardening notes with vulnerabilities

A defense-in-depth gap is not a finding if another layer blocks the attack. Push these notes as vulnerabilities and you destroy the credibility of the entire report. Solution: require a concrete attack scenario for every ticket opened, just as the skill does.

Mistake 4: Believing 90% precision = zero false positives

This median precision comes from a blind test on a repo profile, with six gaps listed and Cloudflare remaining silent as of 19/09. Solution: keep a human review of MEDIUM+ findings before opening tickets — FINDINGS-DETAIL.md is made for that.

❓ Frequently Asked Questions

Which agents can run security-audit-skill?

Any "skills"-compatible agent capable of launching sub-agents in parallel: Claude Code, OpenCode, Codex CLI. The pipeline relies on the Task tool and on hunting agents capable of generating their own investigation sub-agents. An agent without parallel orchestration will only execute a fraction of the pipeline.

How much does an audit cost?

The skill is free (MIT); you pay for inference. The September 19, 2026 blind test measured a median of $29.95 per run for the quick profile, versus $2.06 for a single-agent. On a critical repo with 3 to 5 runs, budget a few dozen dollars — it varies depending on the model and repo size.

Does it replace a pentest?

No. Recall caps at 47% on the planted facts of the blind test: it's a traceable, validated first pass, not a guarantee of exhaustiveness. Keep the human pentest on critical surfaces — but the skill drastically reduces the upfront review time.

Does it find business logic flaws?

Yes, and that's its decisive advantage over Semgrep or CodeQL, which fail precisely on business logic flaws that require contextual understanding. But coverage isn't exhaustive: that's why the recommended method is additive multi-runs with a coverage ledger.

Can I use it on private code, and commercially?

Yes: MIT license, so commercial use, modification, and redistribution are allowed. And since the skill runs inside your agent, you can run it with self-hosted models (Kimi K2.6, GLM-5) so that no line of code ever leaves your infrastructure.

✅ Conclusion

Cloudflare has just released the starting point of its internal vulnerability discovery system under MIT — and an independent blind test confirms both the accuracy (90% median) and the price to pay (about 14x a single-agent). Clone the repo, run an audit on a codebase you know inside out, and compare it with your static analysis: you'll have your answer in a single run. To keep up with this kind of release, our roundup of AI news is updated continuously.