A methodology packaged as a skill
Cloudflare Security Audit Skill is not a vulnerability scanner with an agent interface. It is a set of instructions, prompts, schemas, and a validator that tells a capable coding agent how to conduct a source-based security review. The distinction matters. Semgrep and CodeQL apply repeatable rules or queries. This project coordinates judgment: map the system, attack it from several directions, challenge every result, and reconcile the final claims with the code.
The six phases are reconnaissance, hunting, validation, reporting, structured output, and independent verification. Reconnaissance maps architecture, trust boundaries, and input surfaces into architecture.md. Multiple hunters then explore injection, access control, business logic, cryptography, feature abuse, chained attacks, and less obvious angles. Separate agents try to disprove each candidate. The main agent produces a readable report, detailed traces for medium-or-higher findings, and schema-validated JSON. Fresh agents finally check factual claims against source.
That workflow directly addresses the worst behavior of AI security reviews: plausible prose outrunning evidence. The instructions repeatedly demand a concrete attacker, action, and outcome. A missing defense layer is a hardening note when another layer blocks exploitation. Severity combines likelihood and impact, and a source-only theory that depends on unavailable infrastructure must be labeled as requiring deployment testing rather than confirmed.
The best feature is adversarial separation
Most security prompts ask one model to find and judge its own findings. This skill assigns those jobs to different contexts. A hunter has an incentive to pursue an attack. A validation agent is told to kill false positives. The final verification wave checks the structured report against the target code again. That separation cannot guarantee correctness, but it makes unsupported claims work harder to survive.
The attack material is broader than a web checklist. The repository has specialized guidance for native memory safety and binaries, AI and LLM systems, HTTP protocol and authentication behavior, and browser-side security. The core skill also tells agents to identify relevant comparison projects dynamically, test parser or runtime assumptions, inspect business logic, and execute a minimal harness when possible. These are useful review habits even if no vulnerability is found.
Machine-readable output is another smart decision. findings.json follows a supplied schema and is checked by a zero-dependency Node.js validator. Confirmed and rejected findings can therefore be retained as evidence, compared across runs, or transformed for another system. The repository already has an open pull request for a SARIF converter, but because that work is not merged, buyers should treat SARIF as a contribution under review rather than a current feature.
A run is neither quick nor complete
Installation is short: use the Skills CLI, select security-audit, and optionally install it globally. Actual operation is intentionally large. The host needs tool use and parallel subagents. Those agents read a potentially substantial codebase, fan out across attack classes, launch focused researchers, challenge findings, and return material for four artifacts. Model cost and elapsed time will grow with repository size and the number of credible leads.
The project is candid about coverage. Its instructions say no single run finds everything and report that the best single run in testing found roughly half of the total vulnerabilities found across multiple runs. Prior findings.json files are read so later audits can skip known results and target neglected areas. This makes repeat runs productive, but it also means a clean first report cannot support a clean-bill-of-health claim.
Dynamic proof has practical prerequisites too. The skill prefers building the target, running a payload, comparing parser behavior, or extracting suspect code into a small harness. That is excellent practice when dependencies and safe test data are available. It is harder on a proprietary service requiring unavailable infrastructure, a production-only authentication chain, or a codebase that cannot be executed safely. The instructions handle this honestly by withholding confirmation, but the resulting report may contain fewer answers than a stakeholder expects.
Host compatibility is the fragile layer
The methodology calls itself agent-neutral and defines generic roles such as a research agent, general agent, and task tool. In principle, a host maps those roles to its own delegation mechanism. In practice, the quality of parallel execution, context isolation, and trigger selection varies. Open issue #11 reports that Antigravity kills parallel subagents, which breaks a core requirement rather than a cosmetic integration.
Automatic triggering can also collide with other installed skills. Issue #5 describes another security skill taking over even when the README's sample wording was used. A direct slash command has been requested, and a related pull request exists, but neither should be counted as shipped while it remains open. Users with crowded skill sets should test activation on a disposable repository before assuming the correct auditor will run.
Security boundaries around the agent itself remain the operator's responsibility. An auditing agent may read secrets, run builds, execute crafted input, and inspect sensitive code. Use a sandbox, restrict network and credentials, review commands, and never point an autonomous test at production merely because dynamic confirmation is preferred. The skill improves audit reasoning; it does not create an execution isolation layer.
Health and the buying decision
This is a young repository, created June 18, 2026 and last pushed July 6. It had about 3,004 stars on August 21, a striking amount of early attention. Six open items included three issues and three pull requests, with activity continuing through August 20. There is no latest GitHub release, so users install the moving repository rather than choosing a tagged, documented version. That combination suggests active interest but limited release maturity.
Adopt it as a force multiplier for an existing security program, not as proof that one person plus an agent has completed an assessment. Pair it with dependency scanning, repeatable static analysis, ordinary tests, and human review of every high-impact claim. On a host with reliable parallel agents, its evidence standards and adversarial checks are unusually thoughtful. On a host without them, the central design collapses into another long prompt.