Coding agents can perform and verify security audits in six stages
Point a coding agent at a codebase and ask for a security audit, and it produces machine-readable results through a six-stage process from reconnaissance to independent verification. This repository is a single-repository skill that served as the starting point for Cloudflare's vulnerability discovery system. The structure has one agent attempt to disprove findings made by another, reducing false positives and generating reliable reports.
Six-stage audit flow and independent verification
The audit proceeds through six stages: reconnaissance, coverage-based exploration, candidate verification, structured output, independent record verification, and target-neutral reporting. In stage 1, the architecture and trust boundaries are recorded in architecture.md and coverage-ledger.json. In stage 2, isolated agents explore for vulnerabilities based on this list. In stage 3, all discovered candidates are confirmed by a new verification agent attempting to disprove them. In stage 4, results are recorded in findings.json with one of three verdicts: confirmed, needs_validation, or rejected. In stage 5, another independent agent verifies the final source claims. In stage 6, reports such as REPORT.md are generated based on the verified records and coverage list. Throughout this process, the verification agent is always different from the discovery agent, which is a core design element for reducing false positives.
Coverage-based exploration and iterative execution
This skill tracks which parts have already been inspected via coverage-ledger.json. Running it multiple times on the same repository allows it to use records from previous runs to focus on uninspected areas and re-verify changed source code. According to the README, a single run found only about half of the vulnerabilities discovered through iterative runs, indicating that iterative execution is effective for increasing coverage. validate-coverage-ledger.cjs and validate-findings.cjs are dependency-free validation tools that check the integrity of records at each stage.
Installation and execution
Install it via the Skills CLI using the command npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit. Add the --global option for user-level installation. To use it, point a coding agent at the target codebase and make a request such as 'security audit this codebase' to activate it automatically. In full audit mode, if no output directory is specified, ~/security-audit-skill/<repo-name>/run-<N> is used as the default. Files are written inside the target repository only if a directory ignored by version control is explicitly selected.
Required execution environment
An OS-enforced sandbox is mandatory for building, testing, and executing processes of the target code. This sandbox must block external network access, use only allowed environment variables, enforce resource limits, and permit writes only to specified temporary paths. Without these controls, the workflow will not execute the target code and will keep relevant items in the needs_validation state. This design prevents risks that can occur when a security audit tool executes target code.
Pre-application checks
This skill is provided under the MIT license and is a single-repository starting point derived from Cloudflare's vulnerability discovery system. Lack of defensive depth is treated as a hardening note rather than a vulnerability, and severity is determined by the product of impact and likelihood. If the sandbox environment is not set up, execution of the target code is restricted, so you must verify an OS-level isolation environment before running. Additionally, since iterative runs discover more vulnerabilities than single runs, it is recommended to run it multiple times for important projects.
