TopGit tracks cloudflare/security-audit-skill on GitHub. The project has 7.5k stars. A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings
Snapshot summary built from the project's own GitHub metadata — there's no written TopGit review yet. The page will update automatically when a full review is published.
WHY NO REVIEW YET
TopGit writes full reviews for the most-starred, most-requested repositories. This page is a snapshot until then — see the READ ME tab for the original README in full.
A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.
This is the skill that seeded Cloudflare's vulnerability discovery harness, described in Build your own vulnerability harness. The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.
What it does
The skill runs a structured audit in six phases:
Reconnaissance -- map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json.
Coverage-led hunting -- assign isolated hunters from ledger units, record their checks, and use coverage critics to find gaps.
Candidate validation -- give every unique candidate to a fresh verifier that tries to disprove it.
Structured output -- write confirmed, needs_validation, and rejected records to findings.json and validate them against report-schema.json.
Independent record verification -- fresh agents verify final source claims. Material replacements receive another independent verifier.
Target-neutral reporting -- derive REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from the verified records and coverage ledger.
The parent runs validate-coverage-ledger.cjs after creating the ledger and after each later ledger update. It runs validate-findings.cjs in Phase 4 and again after every Phase 5 replacement.
The verdicts are distinct: confirmed has a complete source trace and bounded observed result, needs_validation has an exact unresolved fact and no severity, and rejected records a disproved candidate.
Multiple runs against the same repo are additive. The skill uses prior ledgers and findings to target gaps, revalidate changed source, and carry forward current-source evidence without treating stale or unresolved work as covered.
Files
File
Purpose
SKILL.md
Setup, core principles, platform terminology, workflow overview, and audit anti-patterns
RECONNAISSANCE.md
Phase 1 reconnaissance prompts and synthesis instructions
HUNTING.md
Phase 2 orchestration, hunting methodology, and validation rules
ATTACK-CLASSES.md
Core, wildcard, and obvious-things attack prompts
MEMORY-SAFETY-AND-BINARY.md
Memory-safety, binary, and kernel hunting classes for native targets
AI-AND-LLM.md
Prompt-injection, agent/tool, and output-handling hunting classes for LLM-backed targets
WEB-PROTOCOL-AND-AUTH.md
HTTP request-framing, cache, and authentication-protocol hunting classes for HTTP-protocol and auth targets
CLIENT-SIDE.md
DOM-injection, messaging-trust, UI-redress, and prototype-pollution hunting classes for client-side/browser targets
SUPPLY-CHAIN-AND-RELEASE.md
Dependency, CI, release, signing, update, plugin, and extension hunting classes
CLOUD-AND-DEPLOYMENT.md
IAM, infrastructure-as-code, container, serverless, ingress, and runtime-configuration hunting classes
PROTOCOLS-RPC-AND-MESSAGING.md
RPC, serialization, queue, broker, webhook, and streaming-protocol hunting classes
RESOURCE-EXHAUSTION-AND-AVAILABILITY.md
Shared resource, quota, queue, worker, and operator-spend hunting classes
Run npx skills --help for agent-selection and non-interactive options.
Usage
Start your coding agent in (or pointed at) the codebase you want to audit, then ask it to do a security audit:
security audit this codebase
find security vulnerabilities in ./src
do a security review, output to ~/audits/my-project
The skill activates automatically when the request matches its trigger (security audit, find vulnerabilities, pen-test the code, etc.). A direct codebase audit or pen-test request uses full audit mode. Security questions and focused vulnerability work use guidance mode unless you request report artifacts. In full audit mode, an unspecified output directory defaults to ~/security-audit-skill/<repo-name>/run-<N>. The workflow writes inside the target repository only when you explicitly select a directory that version control ignores.
Requirements
A coding agent with a model that supports tool use and parallel sub-agents
Node.js for the zero-dependency findings and coverage-ledger validators
An OS-enforced sandbox for target-controlled builds, tests, processes, browsers, emulators, fuzzers, and fixtures. It must disable external networking, use a sanitized allowlisted environment, enforce resource limits, and allow writes only to assigned scratch paths. Without these controls, the workflow keeps the lead as needs_validation instead of executing target code.
Design principles
Only confirm established boundary failures. Keep a source-grounded blocked lead as needs_validation with its exact unresolved fact.
Adversarial validation. The agent that checks a finding is never the agent that found it.
Severity requires impact. Likelihood x impact, not deviation from a checklist.
Defense-in-depth gaps are not vulnerabilities. If Layer A prevents the attack, the absence of Layer B is a hardening note.
Multiple runs improve coverage. In our test runs, a single run found roughly half of the vulnerabilities that repeated runs found in total.
Contact
Questions, feedback, or comparing notes on AI-driven security tooling: [email protected]
How active is development on cloudflare/security-audit-skill?
The most recent commit recorded on cloudflare/security-audit-skill was 9 days ago, based on the GitHub push timestamp. The repository has 430 forks — one of the better signals of community interest.
How many stars does cloudflare/security-audit-skill have?
cloudflare/security-audit-skill has 7.5k GitHub stars — refresh the page for the live number, or check github.com/cloudflare/security-audit-skill. TopGit mirrors GitHub's count but does not claim minute-by-minute accuracy.
Is cloudflare/security-audit-skill open source?
Yes — cloudflare/security-audit-skill ships under the MIT license, which makes its source code freely readable (and, depending on license terms, forkable and reusable). Source: github.com/cloudflare/security-audit-skill.
What is cloudflare/security-audit-skill?
cloudflare/security-audit-skill (cloudflare/security-audit-skill) is a JavaScript project on GitHub. From the project's own README: A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings
Where do I read more about cloudflare/security-audit-skill?
This TopGit page is a snapshot — the READ ME tab shows the project's own README content (links stripped, images preserved). The GitHub repository at github.com/cloudflare/security-audit-skill is the definitive source.
Read full README in the tab above.
Want a second opinion on security-audit-skill?
Ask an AI that can read this page — one click and you get its take on security-audit-skill.
/security-audit-skill