Cloudflare open-sourced the coding agent skill behind its vulnerability harness

Cloudflare has open-sourced security-audit, the coding-agent skill it says was the starting point for its own company-wide vulnerability discovery system. The repository is MIT licensed, has 8,918 stars on GitHub, and its Hacker News submission reached 77 points in six hours.

What the skill does

The README describes a workflow that turns a coding agent into a security auditor by coordinating separate sub-agents through six phases: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. New verifier agents try to disprove findings from the agents that search for bugs, and a separate pass checks that every finding's cited file and line number matches the source. The output is a machine-readable JSON record for each verified finding, alongside a markdown report.

Requirements

The skill needs a coding agent whose model supports tool use and parallel sub-agents, and an OS-enforced sandbox for the target's builds, tests, browsers, and fuzzers. The sandbox must disable external networking, sanitise the environment, and cap resources. Node.js is required for the validators. The README states plainly that a single run finds "roughly half of the vulnerabilities that repeated runs found in total", so multiple runs against the same repository are expected.

Why it exists

In a June 2026 engineering post, Cloudflare wrote that this skill was the starting point for its Vulnerability Discovery Harness. The company says it scanned 128 repositories, generated 20,799 raw candidates, and left 12,057 findings that passed validation, a 58 percent high-integrity rate. Its Vulnerability Validation System added deduplication and reachability checks and delivered 7,245 actionable findings to engineering teams, per that same post. Those numbers describe Cloudflare's internal system, not what a third party will see on its own codebase.

Two Hacker News commenters raised concerns about the token cost of running it. One reported spending "1M tokens for nothing" on a medium codebase, and another said they needed "at least 150k on my relatively small FastAPI project". The skill is designed for repeated runs, and the audit is model-agnostic by design, so the cost depends on the model a team chooses to run it with.

For a working developer, the value here is that Cloudflare is sharing the skill file it uses in-house, along with the blog post explaining what it built with it. A team can install the skill on Claude Code or Codex tomorrow, run it against one repository, and see whether the JSON findings still hold after a second pass by a different model that tries to disprove them. What a team decides to do with the findings, whether to treat them as leads or as work items, is where the real cost is. Reachability was the step Cloudflare added to this skill so engineering teams would not receive too many false positives, and the repository does not include it.

Source

cloudflare/security-audit-skill on GitHub. Cloudflare's engineering post that explains the skill, Build your own vulnerability harness, 18 June 2026.