AI agent becomes security auditor

Cloudflare released security-audit-skill, an open-source tool that transforms coding agents into systematic security auditors. It orchestrates isolated agents through six structured phases to find and verify vulnerabilities.

Six-phase audit workflow

The skill runs reconnaissance to map architecture, coverage-led hunting to find gaps, candidate validation to test findings, structured output to categorize results, independent verification of claims, and target-neutral reporting.

Three verdict categories

Findings are marked confirmed (complete source trace and bounded result), needs-validation (exact unresolved fact, no severity), or rejected (disproved candidate). This prevents false positives and keeps uncertain leads transparent.

Adversarial validation prevents bias

The agent that validates a finding is never the agent that found it. This independent verification approach ensures findings are genuinely sound, not just plausible to their discoverer.

“Adversarial validation. The agent that checks a finding is never the agent that found it.”

Repeated runs find more vulnerabilities

Multiple audit runs against the same codebase are additive. Test runs showed a single pass found roughly half the vulnerabilities that repeated runs discovered in total, making iteration valuable.

“In our test runs, a single run found roughly half of the vulnerabilities that repeated runs found in total.”

Easy installation and activation

Install via npm with a single command, then ask your agent to audit code. The skill auto-activates on security-related requests and outputs findings to JSON files with schema validation.

Sandbox required for safe execution

The skill needs an OS-enforced sandbox that disables external networking, limits resources, and restricts file writes. Without these controls, findings stay marked needs-validation instead of executing target code.