Cloudflare open-sources the coding-agent skill behind its own vulnerability harness

Cloudflare has open-sourced security-audit, the coding-agent skill it says seeded its own fleet-wide vulnerability discovery system. The repository is MIT licensed, sits at 8,918 stars on GitHub, and its Hacker News submission reached 77 points in six hours.

What the skill does

The README describes a workflow that turns a coding agent into a security auditor by orchestrating separate sub-agents through six phases: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. Fresh verifier agents try to disprove findings from the hunter agents, and a separate pass checks that every finding's cited file and line number matches the source. The output is a machine-readable JSON record for each verified finding, alongside a markdown report.

Requirements

The skill needs a coding agent whose model supports tool use and parallel sub-agents, and an OS-enforced sandbox for the target's builds, tests, browsers, and fuzzers. The sandbox must disable external networking, sanitise the environment, and cap resources. Node.js is required for the validators. The README states plainly that a single run finds "roughly half of the vulnerabilities that repeated runs found in total", so multiple runs against the same repository are expected.

Why it exists

In a June 2026 engineering post, Cloudflare wrote that this skill was the seed for its Vulnerability Discovery Harness. The company says it scanned 128 repositories, generated 20,799 raw candidates, and left 12,057 findings that survived validation, a 58 percent high-integrity rate. Its Vulnerability Validation System added deduplication and reachability checks and delivered 7,245 actionable findings to engineering teams, per that same post. Those numbers describe Cloudflare's internal system, not what a third party will see on its own codebase.

Two Hacker News commenters flagged the token cost of running it. One reported spending "1M tokens for nothing" on a medium codebase, and another said they needed "at least 150k on my relatively small FastAPI project". The skill is designed for repeated runs, and the audit is model-agnostic by design, so the bill scales with the model a team chooses to point at it.

For a working developer, the value here is that Cloudflare is handing over the skill file it uses in-house, along with the blog post explaining what it built on top. A team can install the skill on Claude Code or Codex tomorrow, run it against one repository, and see whether the JSON findings survive a second, adversarial pass by a different model. What a team decides to do with the findings, whether to treat them as leads or as work items, is where the real cost sits. Reachability was the step Cloudflare added on top of this skill to keep engineering teams from drowning in false positives, and the repository does not include it.

Source

cloudflare/security-audit-skill on GitHub. Cloudflare's engineering post that put the skill in context, Build your own vulnerability harness, 18 June 2026.