linkgo
security-audit-skill

security-audit-skill

AI

Open-source coding-agent skill from Cloudflare that runs multi-phase security audits with adversarially verified, machine-readable findings.

-(0 Reviews)
Free Available
Starting from Free
Visit Official Site

About security-audit-skill

security-audit-skill is a coding-agent skill published by Cloudflare that turns an AI coding agent into a structured security auditor. It orchestrates isolated sub-agents through six phases: reconnaissance of architecture and trust boundaries, coverage-led hunting driven by a coverage ledger, adversarial validation where a fresh verifier tries to disprove each candidate, schema-validated structured output, independent record verification, and target-neutral reporting. Findings are classified as confirmed, needs-validation or rejected in findings.json, validated by zero-dependency Node.js scripts, and rendered into REPORT.md and detail files. Repeated runs are additive, reusing prior ledgers to target gaps. It is the single-repo starting point that seeded Cloudflare's internal vulnerability discovery harness and is released under the MIT license.

Screenshots

security-audit-skill screenshot 1
+

Key Features

Six-Phase Audit Workflow: Reconnaissance, coverage-led hunting, candidate validation, structured output, independent verification and reporting, run by isolated agents.
Coverage Ledger: Maps architecture, trust boundaries and input surfaces into coverage-ledger.json so hunters are assigned systematically and gaps are found by coverage critics.
Adversarial Validation: Every candidate goes to a fresh verifier that tries to disprove it; the agent checking a finding is never the one that found it.
Machine-Readable Findings: Confirmed, needs-validation and rejected records in findings.json validated against a JSON schema with zero-dependency Node.js validators.
Extensive Attack-Class Library: Hunting prompts for memory safety, LLM/prompt injection, web protocol and auth, client-side, supply chain, cloud, RPC, data isolation and local IPC targets.
Additive Multi-Run Coverage: Subsequent runs reuse prior ledgers and findings to target gaps and revalidate changed source.
Sandbox-Aware Execution: Requires an OS-enforced sandbox for running target code; without it, leads stay as needs-validation instead of executing untrusted code.

Use Cases

Pre-Release Code Audit: Running a full security audit on a repository with a coding agent before shipping.
Building an Internal Vulnerability Harness: Using the skill as the starting point for a larger automated vulnerability discovery pipeline.
LLM Application Review: Hunting prompt-injection and tool-misuse issues in LLM-backed services.
Supply Chain and CI Review: Checking dependencies, release, signing and CI configurations for weaknesses.
Triage-Ready Reporting: Producing verified, schema-validated findings that security teams can ingest automatically.

Frequently asked questions about security-audit-skill

What is security-audit-skill?

Open-source coding-agent skill from Cloudflare that runs multi-phase security audits with adversarially verified, machine-readable findings.

How does security-audit-skill work?

security-audit-skill works by combining Six-Phase Audit Workflow: Reconnaissance, coverage-led hunting, candidate validation, structured output, independent verification and reporting, run by isolated agents., Coverage Ledger: Maps architecture, trust boundaries and input surfaces into coverage-ledger.json so hunters are assigned systematically and gaps are found by coverage critics., Adversarial Validation: Every candidate goes to a fresh verifier that tries to disprove it; the agent checking a finding is never the one that found it., Machine-Readable Findings: Confirmed, needs-validation and rejected records in findings.json validated against a JSON schema with zero-dependency Node.js validators., Extensive Attack-Class Library: Hunting prompts for memory safety, LLM/prompt injection, web protocol and auth, client-side, supply chain, cloud, RPC, data isolation and local IPC targets. to help users with Pre-Release Code Audit: Running a full security audit on a repository with a coding agent before shipping., Building an Internal Vulnerability Harness: Using the skill as the starting point for a larger automated vulnerability discovery pipeline., LLM Application Review: Hunting prompt-injection and tool-misuse issues in LLM-backed services., Supply Chain and CI Review: Checking dependencies, release, signing and CI configurations for weaknesses., Triage-Ready Reporting: Producing verified, schema-validated findings that security teams can ingest automatically..

What are the main features of security-audit-skill?

Key features include Six-Phase Audit Workflow: Reconnaissance, coverage-led hunting, candidate validation, structured output, independent verification and reporting, run by isolated agents., Coverage Ledger: Maps architecture, trust boundaries and input surfaces into coverage-ledger.json so hunters are assigned systematically and gaps are found by coverage critics., Adversarial Validation: Every candidate goes to a fresh verifier that tries to disprove it; the agent checking a finding is never the one that found it., Machine-Readable Findings: Confirmed, needs-validation and rejected records in findings.json validated against a JSON schema with zero-dependency Node.js validators., Extensive Attack-Class Library: Hunting prompts for memory safety, LLM/prompt injection, web protocol and auth, client-side, supply chain, cloud, RPC, data isolation and local IPC targets..

Who is security-audit-skill for?

security-audit-skill is useful for anyone interested in Pre-Release Code Audit: Running a full security audit on a repository with a coding agent before shipping., Building an Internal Vulnerability Harness: Using the skill as the starting point for a larger automated vulnerability discovery pipeline., LLM Application Review: Hunting prompt-injection and tool-misuse issues in LLM-backed services., Supply Chain and CI Review: Checking dependencies, release, signing and CI configurations for weaknesses., Triage-Ready Reporting: Producing verified, schema-validated findings that security teams can ingest automatically..

How much does security-audit-skill cost?

security-audit-skill is free to use.

How do I get started with security-audit-skill?

Visit https://github.com/cloudflare/security-audit-skill to sign up and explore security-audit-skill.

Explore more AI Ai Tools tools

Browse all Ai Tools tools →

Compare security-audit-skill: vs CleanSlop · vs Kalender Sync · vs UseIt Studio · vs Woven Video