Cloudflare Open-Sources security-audit-skill for Coding Agents
Cloudflare open-sourced security-audit-skill, a staged skill pack that runs coding agents through a six-phase, reviewable repository audit. A related VDH and VVS harness write-up cites a funnel from 20,799 raw candidates to 7,245 items sent to engineering.
Release
Cloudflare has open-sourced security-audit-skill, a skill pack for coding agents that runs a staged, reviewable security audit of a repository. Cloudflare describes it as the public core of its internal vulnerability-discovery workflow. The functions in the public project are free to use.
The pack is built around fixed stages, named outputs, and separate finder and verifier agents, rather than a single free-form scan prompt.
Six stages
Isolated agent groups run six phases with stated goals and files.
Reconnaissance. The run maps architecture, trust boundaries, input ports, and prior risk notes, then writes architecture.md and coverage-ledger.json.
Coverage-led hunting. Hunter agents work from that ledger. A coverage checker flags untested or thin regions for follow-up.
Candidate validation. Suspected issues go to a new verifier agent that tries to refute each claim, to cut single-agent bias and false positives.
Structured output. Results land in findings.json in three buckets: confirmed, needs_validation, and rejected, checked against report-schema.json.
Independent record verification. A further agent reviews provenance and conclusions. Code or data changes during the run can trigger extra checks.
Target-neutral reporting. The close produces REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from verified findings and the coverage ledger.
Two zero-dependency scripts run across the flow: validate-coverage-ledger.cjs on ledger writes, and validate-findings.cjs after classification and review. Confirmed items must include a source trace and a reproducible result. needs_validation records unverified points without a severity grade. rejected items keep the refutation notes.
Finder and verifier roles are split. An issue is treated as a vulnerability only if a security boundary fails in a way that can cause harm. A missing extra control that existing defenses already cover is logged as hardening, not as a high-severity bug. Cloudflare's cited tests say one pass finds about half of issues, and later passes focus on gaps, diffs, and leftover needs_validation items.
VDH and VVS
On top of the single-repo skill, Cloudflare describes a vulnerability harness for many repositories, split into VDH (Vulnerability Discovery Harness) and VVS (Vulnerability Validation System). The two sides can use different models. VDH emits raw candidates. VVS deduplicates, judges reachability in production context, and prepares fix drafts. Other scanners can feed VVS.
VDH adds Gapfill, Dedup, Trace, and Feedback agents, plus a script-only Report step that does not spend model tokens on rendering. State is stored outside the model context so a crash does not wipe progress. Each agent is given a narrow task. Trace follows dependency graphs into caller repositories. Feedback updates later prompts from failed validations. Hunter agents may compile in a sandbox and write missing tools or configs to a Wishlist for humans. Out-of-scope paths can be handed to a new sub-agent without resetting the parent job.
Published funnel counts: VDH produced 20,799 raw candidates; 12,057 passed into VVS; 13,841 records after other sources; 5,442 duplicates removed; of 11,544 remaining, 1,154 were wrong-repo assignment or low-risk hardening notes; 7,245 items went to engineering.
Fixing agents may adapt patches to project style and run regression tests. A patch that turns a failing test into a pass still waits for human review before merge.
Documented hunting guides cover memory and binary issues, LLM prompt injection and tool misuse, HTTP and authentication, client DOM injection and prototype pollution, supply chain and CI/CD, cloud and containers, RPC and queues, resource exhaustion, data isolation and lifecycle, and local IPC on desktop and mobile.
Install and limits
Install with Skills CLI:
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit
Add --global for a machine-wide install. npx skills --help lists agent selection and batch options.
In a repo, example prompts include auditing the whole tree, limiting to ./src, or writing output under a chosen path. Guidance mode handles targeted questions. Full audit mode writes a standard folder. The skill writes into the project only when the user points it at an untracked directory.
Requirements: a coding model with tool use and parallel sub-agents, Node.js for the validators, and a system sandbox for build, test, and related runs. The sandbox should block outbound network, whitelist environment variables, cap resources, and restrict writes to named paths. If those sandbox conditions are missing, the skill marks every issue needs_validation and does not run code tests.
GitHub: https://github.com/cloudflare/security-audit-skill