Audit Codebases for Security Bugs
Run a six-phase security audit on your codebase and get verified vulnerability reports with file-and-line source traces, local sandbox reproductions, and the smallest source fix.
Install the skill or give me an instruction how to install it - security-audit from https://github.com/cloudflare/security-audit-skill Free Open source Works in Claude, Cursor, Codex & more
What it does
Point it at a codebase, API, CLI tool, library, or service and get back verified security findings with file-and-line source traces, bounded local reproductions, severity ratings, and the smallest source-level fix. In full audit mode, it writes seven artifacts to a dedicated output folder outside your repo, including REPORT.md, FINDINGS-DETAIL.md, NEEDS-VALIDATION.md, findings.json, coverage-ledger.json, architecture.md, and run-metadata.json.
Instead of running a single pass or flagging checklist gaps, it coordinates isolated sub-agents across six phases: reconnaissance, coverage-led hunting across eight core attack classes and ten domain companions, adversarial candidate validation where a fresh verifier tries to disprove each lead, zero-dependency JSON schema validation, independent record verification, and reporting. Every lead ends in one of three strict verdicts—confirmed, needs_validation, or rejected—and repeated runs reuse prior ledgers to target uncovered paths and changed code.
When to use it
- You want a full security review before shipping a service or API
Run all six phases in quick, standard, or deep profile to map trust boundaries, hunt across entry surfaces, and get schema-validated findings with exact source fixes.
- You need to check a specific PR, path, or security question
Use guidance mode or a scoped run to review named paths, one subsystem, or the diff between two commits without auditing the entire repository.
- Your team re-audits the same repository as code changes
Feed in prior findings.json and coverage-ledger.json files so the next run carries forward unchanged confirmations, revalidates modified code, and targets remaining gaps.
- You are tired of noisy scanners flagging defense-in-depth notes
Filter out speculative warnings with a fresh verifier agent that attempts to refute every candidate before it can receive a confirmed verdict and severity score.
FAQ
How is Security Audit different from a static scanner or a one-shot prompt?
Security Audit separates hunting from verification: isolated hunter agents trace inputs to sinks across a deterministic coverage ledger, and a separate verifier agent tries to disprove each candidate from source and sandboxed local checks. Only boundary failures with an affected principal, resource, and concrete result become confirmed findings.
What tools, accounts, or API keys does it need?
No external accounts or API keys are required. Security Audit needs a coding agent with tool use and sub-agents, Node.js for its two zero-dependency JSON validators, and an OS-enforced local sandbox with network disabled for running target checks. If a sandbox control is missing, it records leads as needs_validation instead of running code.
Will it modify my codebase or probe live endpoints?
No. Security Audit is strictly read-only on your repository and never contacts deployed endpoints, live services, or production data. It writes all reports and JSON records to an external output directory by default, and any local check runs on a disposable copy inside an isolated scratch directory with external networking turned off.
What files do I get back from a full audit run?
You get seven shared artifacts in your output directory: REPORT.md for the executive summary and remediation priorities, FINDINGS-DETAIL.md for deep technical writeups, NEEDS-VALIDATION.md for leads blocked on deployment facts, findings.json, coverage-ledger.json, architecture.md, and run-metadata.json.