---
id: "nr-cloudflare-open-sources-a-six-phase-security-audit-skill-a4e8d6"
slug: "cloudflare-open-sources-a-six-phase-security-audit-skill-a4e8d6"
title: "Cloudflare open-sources a six-phase security audit skill for coding agents"
observed_at: "2026-09-18T13:40:45.45798+00:00"
record_date: "2026-09-18"
date_kind: "observed_at"
novelty: "new"
source_platform: "github.com"
topics: ["security","coding-agents","agent-skills"]
entities: ["Cloudflare","security-audit-skill"]
related_patterns: []
source_url: "https://github.com/cloudflare/security-audit-skill"
source_urls: ["https://github.com/cloudflare/security-audit-skill"]
basket: {"id":"0325e6b8-f527-4f9b-bfa3-3f30e57f380b","revision":1,"cluster_id":"a4e8d638-4715-4866-8b90-5ec04e078e15"}
type: "post"
description: "Cloudflare published security-audit, an MIT-licensed coding-agent skill that runs repository audits in six phases with adversarial validation and schema-checked findings."
why_it_matters: "Useful evidence would be published comparisons of confirmed findings against known vulnerabilities, along with reports from teams operating the required sandbox."
verification_level: "source-inspected"
signal_type: "field_note"
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:cloudflare-open-sources-a-six-phase-security-audit-skill-a4e8d6"
retrieval_nugget: "Cloudflare published security-audit, an MIT-licensed coding-agent skill that runs repository audits in six phases with adversarial validation and schema-checked findings. Cloudflare has published security-audit, an MIT-licensed coding-agent skill that audits a single repository in six phases: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. The repository describes it as the single-repo starting point that seeded"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:7b8b0c212e83f263756e085f5a693894ede3fa26ded8085c9d11f985a7b351a2","reviewed_at":"2026-09-24T13:28:46Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":1,"watch_condition_count":1,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"The design treats a security audit as a pipeline of separated roles rather than a single prompt.","observed_facts":[{"text":"The skill runs a structured audit in six phases, from reconnaissance to target-neutral reporting.","source_urls":["https://github.com/cloudflare/security-audit-skill"]},{"text":"Every unique candidate finding is given to a fresh verifier that tries to disprove it.","source_urls":["https://github.com/cloudflare/security-audit-skill"]},{"text":"Without an OS-enforced sandbox, the workflow keeps a lead as needs_validation instead of executing target code.","source_urls":["https://github.com/cloudflare/security-audit-skill"]}],"mechanism":"Isolated hunters work from units in a coverage ledger, every unique candidate goes to a fresh verifier that tries to disprove it, and findings are written as confirmed, needs_validation, or rejected records that zero-dependency Node.js validators check against a JSON schema.","why_now":"The timing matters because teams are starting to hand security review to coding agents that can plan work, spawn parallel sub-agents, and write their own artifacts.","implications":["One implication is that agent audits can produce machine-readable, schema-validated records that later runs extend, since repeated runs reuse prior ledgers and findings to target gaps."],"evidence_boundary":"The repository does not establish recall or false-positive rates on independent codebases, and its published principles only state that multiple runs improve coverage.","watch_conditions":["Useful evidence would be published comparisons of confirmed findings against known vulnerabilities, along with reports from teams operating the required sandbox."],"related_records":[],"new_branch_reason":"A published, multi-phase agent audit workflow with independent verification is a reusable pattern distinct from single-prompt vulnerability scanning."}
routes: {"html":"https://newruntime.com/posts/cloudflare-open-sources-a-six-phase-security-audit-skill-a4e8d6/","markdown":"https://newruntime.com/posts/cloudflare-open-sources-a-six-phase-security-audit-skill-a4e8d6.md","json":"https://newruntime.com/posts/cloudflare-open-sources-a-six-phase-security-audit-skill-a4e8d6.json"}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
---

# Cloudflare open-sources a six-phase security audit skill for coding agents

## Retrieval answer

Cloudflare published security-audit, an MIT-licensed coding-agent skill that runs repository audits in six phases with adversarial validation and schema-checked findings. Cloudflare has published security-audit, an MIT-licensed coding-agent skill that audits a single repository in six phases: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. The repository describes it as the single-repo starting point that seeded

Cloudflare has published security-audit, an MIT-licensed coding-agent skill that audits a single repository in six phases: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. The repository describes it as the single-repo starting point that seeded Cloudflare's larger vulnerability discovery harness, and it installs through the Skills CLI with npx skills add.

The design treats a security audit as a pipeline of separated roles rather than a single prompt. Isolated hunters work from units in a coverage ledger, every unique candidate goes to a fresh verifier that tries to disprove it, and findings are written as confirmed, needs_validation, or rejected records that zero-dependency Node.js validators check against a JSON schema. The agent that checks a finding is never the agent that found it, and target code runs only inside an OS-enforced sandbox without external networking.

The timing matters because teams are starting to hand security review to coding agents that can plan work, spawn parallel sub-agents, and write their own artifacts. One implication is that agent audits can produce machine-readable, schema-validated records that later runs extend, since repeated runs reuse prior ledgers and findings to target gaps. The repository does not establish recall or false-positive rates on independent codebases, and its published principles only state that multiple runs improve coverage.

Useful evidence would be published comparisons of confirmed findings against known vulnerabilities, along with reports from teams operating the required sandbox.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- topic hub: [Coding Agents](https://newruntime.com/topics/coding-agents.md): Explore the coding-agents topic hub.
- topic hub: [Agent Skills](https://newruntime.com/topics/agent-skills.md): Explore the agent-skills topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)