Development · GitHub repo
security-audit-skill
Coding-agent skill for multi-phase code security audits with verified structured findings
An open-source skill developed by Cloudflare that turns coding agents into multi-phase security auditors. It coordinates isolated sub-agents through reconnaissance, vulnerability hunting, adversarial validation, and schema-verified reporting. Findings are categorized strictly into confirmed, unvalidated, or rejected records with complete source traces.
What it's for
- Run an end-to-end security audit on a codebase using an AI coding agent
- Identify vulnerabilities across diverse domains like web protocols, AI prompt injection, and memory safety
- Validate suspected code vulnerabilities using an independent adversarial sub-agent
- Generate structured, machine-readable security reports with strict schema validation
Features
- Six-phase audit pipeline covering reconnaissance, coverage-led hunting, validation, and reporting
- Adversarial candidate validation ensuring findings are challenged by fresh, independent sub-agents
- Structured output generating validated JSON and markdown reports based on report-schema.json
- Extensive attack-class guides covering LLMs, web protocols, memory safety, supply chain, and cloud infrastructure
- Zero-dependency Node.js validators for coverage ledgers and audit findings
- Additive scanning support that uses previous ledgers to target coverage gaps in repeated runs
Pricing
Free and open source
Details
- Type
- GitHub repo
- Category
- Development
- Topic
- Code Security
- Open source
- Yes
- Platforms
- Command line
- For
- Software engineers, security engineers, and developers using AI coding agents
- Alternative to
- Snyk, Semgrep, SonarQube
- Tags
- security, audit, ai agents, cloudflare, vulnerability scanner, static analysis
Why it was saved
- @LLMpsycho: Runs audits from coding agents (Cursor, Codex) and outputs independently verified, machine-readable findings — automates security review in the dev workflow.
Related
Free scanner checking website readiness for AI agents and emerging standards.
Discovery and security testing platform for exposed internet-facing AI endpoints.
A three-step checklist to isolate and harden runtimes for arbitrary code execution.
Open-source AI pentesting agents that dynamically exploit and validate application vulnerabilities.
Architectural guide for designing command-line tools tailored for AI agent execution
Turn websites and documents into clean, LLM-ready markdown or structured data.
Updated