security-audit

security-audit is an open-source skill from Cloudflare that turns your coding agent into a security auditor. The README says it's the starting point for the vulnerability discovery harness Cloudflare later built. The audit runs in six phases: the agent maps the code's architecture, trust boundaries and input surfaces; isolated sub-agents hunt through a coverage ledger section by section; every candidate goes to a fresh verifier whose job is to disprove it; results are written as confirmed, needs-validation or rejected records in structured files; and new agents verify the final records before the report is written. You can audit the same codebase again, and later runs target the gaps earlier ones left. What sets it apart is that the agent that finds a problem is never the one that confirms it, so the agents check each other to cut down false alarms.

Who it's for:developers and security engineers who want a systematic security review of their own projects. Readers who don't write code won't have a use for it.

Before you start: install it with npx skills add. You need a coding agent whose model supports tool use and parallel sub-agents, plus Node.js. Use it only on codebases you own or are authorized to test. The README requires an OS-enforced sandbox for any build, test or fuzzing that runs the target's code, with external networking disabled, resource limits and writes limited to assigned folders; without one, it records the lead for later instead of running anything. The audit has the agent read your whole codebase, which goes to your model provider and is billed as usual. Reports go to a folder in your home directory by default. MIT licence.

Based on the project's public documentation. Not tested by AI Inspiration World.