How to find code vulnerabilities with Cloudflare's security-audit skill

security-audit, open-sourced by Cloudflare, is a skill that turns your coding agent into a security auditor. Sub-agents split reconnaissance, vulnerability hunting, and adversarial validation, and only candidates that another agent fails to disprove land in the report as confirmed.

1. Install it from your project folder with the Skills CLI. It needs Node.js 22.20 or later, and the installer asks which agents to install to. Add --global to make it available across projects.

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit

1. Start your agent in the repository you want to audit and ask:

security audit this codebase

Unless you choose another location, results go to ~/security-audit-skill/<repo-name>/run-<N>: REPORT.md, FINDINGS-DETAIL.md for confirmed findings, and NEEDS-VALIDATION.md for open leads.

It needs an agent that supports parallel sub-agents. Checks that build or run target code happen only inside an OS-enforced sandbox with no external network; without one, those leads stay as needs-validation. In Cloudflare's test runs, a single run found roughly half of what repeated runs found, and later runs on the same repo build on earlier results to target gaps.