# security-audit-skill

> Coding-agent skill for multi-phase code security audits with verified structured findings

An open-source skill developed by Cloudflare that turns coding agents into multi-phase security auditors. It coordinates isolated sub-agents through reconnaissance, vulnerability hunting, adversarial validation, and schema-verified reporting. Findings are categorized strictly into confirmed, unvalidated, or rejected records with complete source traces.

Website: https://github.com/cloudflare/security-audit-skill

## What it is for

- Run an end-to-end security audit on a codebase using an AI coding agent
- Identify vulnerabilities across diverse domains like web protocols, AI prompt injection, and memory safety
- Validate suspected code vulnerabilities using an independent adversarial sub-agent
- Generate structured, machine-readable security reports with strict schema validation

## Features

- Six-phase audit pipeline covering reconnaissance, coverage-led hunting, validation, and reporting
- Adversarial candidate validation ensuring findings are challenged by fresh, independent sub-agents
- Structured output generating validated JSON and markdown reports based on report-schema.json
- Extensive attack-class guides covering LLMs, web protocols, memory safety, supply chain, and cloud infrastructure
- Zero-dependency Node.js validators for coverage ledgers and audit findings
- Additive scanning support that uses previous ledgers to target coverage gaps in repeated runs

## Pricing

Free and open source

## Details

- Type: GitHub repo
- Category: [Development](https://xiry.app/topics/development.md)
- Open source: yes
- Platforms: Command line
- For: Software engineers, security engineers, and developers using AI coding agents
- Alternative to: Snyk, Semgrep, SonarQube
- Tags: security, audit, ai agents, cloudflare, vulnerability scanner, static analysis

## Why it was saved

- [@LLMpsycho, 14 September 2026](https://x.com/LLMpsycho/status/2099473233787388049): Runs audits from coding agents (Cursor, Codex) and outputs independently verified, machine-readable findings — automates security review in the dev workflow.

## Related

- [Is Your Site Agent-Ready?](https://xiry.app/resources/is-your-site-agent-ready): Free scanner checking website readiness for AI agents and emerging standards. (Web app, Free)
- [AIMap](https://xiry.app/resources/aimap): Discovery and security testing platform for exposed internet-facing AI endpoints. (Web app, Open source)
- [Sandbox Hardening Checklist for Code-Executing Agents](https://xiry.app/resources/sandbox-hardening-checklist-for-code-executing-agents): A three-step checklist to isolate and harden runtimes for arbitrary code execution. (Tip, Free)
- [Strix](https://xiry.app/resources/strix): Open-source AI pentesting agents that dynamically exploit and validate application vulnerabilities. (GitHub repo, Open source)
- [You Need to Rewrite Your CLI for AI Agents](https://xiry.app/resources/you-need-to-rewrite-your-cli-for-ai-agents): Architectural guide for designing command-line tools tailored for AI agent execution (Article or course, Free)
- [Firecrawl](https://xiry.app/resources/firecrawl-1984): Turn websites and documents into clean, LLM-ready markdown or structured data. (Website, Freemium)

Updated 10 October 2026. Page: https://xiry.app/resources/security-audit-skill

Make your own library: Xiry takes your saved reels, tweets, Reddit bookmarks and Watch Later videos, makes them searchable and pulls the useful stuff out, like this library. It's invite-only for now; join the waitlist at https://xiry.app/#waitlist.