# cloudflare/security-audit-skill

A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings

Repository: https://github.com/cloudflare/security-audit-skill
Canonical: https://ross.abutalabs.com/products/security-audit-skill
Language: JavaScript
License: MIT
License Family: permissive
Last push: 2026-07-06T13:36:03+00:00

## Health v2 (maintenance only)
Score: 54/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 91, release rhythm 35, longevity 5
- inputs: {"age_days": 76, "days_push": 58, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, young
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3077, forks 228 (observed 2026-08-28T04:07:41.121122+00:00)

## What it is
A coding-agent skill from Cloudflare that turns an LLM coding agent into a security auditor via a six-phase pipeline (recon, hunting, validation, reporting, structured output, independent verification). It produces machine-readable findings.json validated against a JSON schema, with adversarial verification to eliminate false positives.

## Use cases
- audit a codebase for exploitable vulnerabilities with an AI agent
- run multi-agent security review on a repository
- generate machine-readable security findings with verified evidence
- reduce false positives in automated vulnerability discovery
- build a vulnerability discovery harness for my repos
- find injection, access control, and business logic bugs in my code
- security audit skill for Claude Code or similar agents

## When to choose
- you want an automated, multi-phase security audit driven by a coding agent
- you need independently verified, schema-validated findings rather than raw LLM output
- you want additive audits that skip known issues across repeated runs
- you target web, client-side, LLM-backed, or native/memory-safety codebases

## When to avoid
- you need a traditional deterministic SAST/DAST scanner without LLM costs
- you require compliance-certified scanning or guaranteed coverage
- your environment cannot run multiple parallel LLM agents
- you need real-time or CI-gate scanning with low latency

## Facets
- artifact type: plugin
- maturity: active
- function: vulnerability-scanning, penetration-testing, security, agent-framework, code-review
- domain: security, developer-tools, artificial-intelligence
- platform: cli, cross-platform
- tags: coding-agent-skill, security-audit, llm-agents, vulnerability-discovery, multi-agent-orchestration, findings-schema, false-positive-reduction, ai-agents, nodejs

## Member repositories
- cloudflare/security-audit-skill (main) score 54

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:41.121122+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:27:53.475937+00:00, confidence not recorded.
  - readme: https://github.com/cloudflare/security-audit-skill (fetched 2026-08-28T04:07:41.121122+00:00, sha 3b9ea2dc8404)
- Data as of 2026-08-30T08:39:29.467469+00:00.