Repo of the Week · Week 44, 2026

Security Audit Skill: Cloudflare's security audit for your coding agent

A free add-on that makes your AI coding agent check your code for security holes, with a second agent double-checking every finding.

What’s a repo? cloudflare/security-audit-skill on GitHub

⭐ 47k starsFree · MITInstalls into Claude Code, Codex and Cursor

See how to use it

cloudflare/security-audit-skillMIT

A coding-agent skill that turns your agent into a security auditor.

Stars: 47.4k
Forks: 2.9k
npm / week: –
Latest: v–

JavaScript · Created Jun 18, 2026 · Last push Sep 14, 2026 · ~4 contributors

View on GitHub Cloudflare blog

💡

What it is

You install it into your coding agent and ask for a security audit. The agent maps your project, sends helper agents to hunt for weak spots, then has fresh agents try to prove each finding wrong. What survives is marked confirmed; what it can't prove is listed separately with the missing fact.

🧑‍💻

Who it’s for

People who build apps with an AI coding agent and want a structured security review of their own code before they ship.

🧰

What you need

A coding agent that can use tools and run sub-agents in parallel (for example Claude Code or Codex), Node.js for the Skills CLI and the validators, and your own repo. Running your code during the audit needs a locked-down sandbox; without one, the skill only reads the source.

Why it’s trending

Created Jun 18, 2026, it now has 47,354 stars and 2,938 forks (GitHub API, Oct 26, 2026). GitHub Trending shows 15,072 new stars this week. On X, 422 original posts mentioned Security Audit Skill in the past 7 days; the 50 we read came from 48 different people. Here’s what people are sharing:

Reaction
Cloudflare open-sourced the security audit skill that seeded its own vulnerability hunting harness, and your coding agent can run it on your code: 4,034 likes, 378 reposts, 6,982 bookmarks.
@RoundtableSpace · Oct 19, 2026 ↗
Trending
Anthropic, OpenAI, Cloudflare and Google have all released AI tools that hunt security bugs in your code. Here's each one and how to run it.
@RoundtableSpace · Oct 20, 2026 ↗
Reaction
So many vulnerabilities are being introduced due to engineering velocity: 3 open-source repos to keep yourself in check, Cloudflare's security audit first.
@marklaunches · Oct 19, 2026 ↗
Trending
The fastest-growing repo on GitHub today is a security-audit skill for coding agents: 39,633 stars, 2,979 of them in the last day.
@Kaviyarasu138 · Oct 23, 2026 ↗
Trending
GitHub weekly risers #1: +12,680 stars this week, 45,511 total (in Japanese).
@githubaitrend · Oct 25, 2026 ↗
How-to
Three steps from the README: install, say "security audit this codebase" in Claude Code or Codex, then read REPORT.md. One run finds about half of what several runs find (in Chinese).
@Rakel076 · Oct 25, 2026 ↗
Concern
The real test is the false-positive rate on a repo you already know is clean, and whether a re-run gets the same findings.
@tracewithines · Oct 21, 2026 ↗
Caution
Tried it with Codex on repos he owns; after 30 minutes Codex stopped with "This content can't be shown" and a link to apply for broader cybersecurity access.
@FrG_FM · Oct 22, 2026 ↗

X counts: X API recent counts and search, 2026-10-19 to 2026-10-26 (original posts (no reposts or replies) mentioning security-audit-skill, its GitHub URL, or Cloudflare with security audit and skill; no post from @Cloudflare or @CloudflareDev about the skill was found in the window).

What it checks

An open-source skill from Cloudflare that turns a coding agent into a security auditor. It runs isolated agents through six phases: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification and reporting. The agent that checks a finding is never the one that found it, and every finding is filed as confirmed, needs_validation or rejected. Cloudflare says it is the skill that seeded its own vulnerability discovery harness.

Six-phase audit

Reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification and target-neutral reporting

A second agent tries to disprove each finding

Every candidate goes to a fresh verifier that tries to prove it wrong; the finder never checks its own work

Three clear verdicts

confirmed (full source trace), needs_validation (one exact unresolved fact, no severity) and rejected (disproved), in findings.json checked against report-schema.json

Web, auth and client-side attack classes

HTTP request framing, cache and auth protocols, DOM injection, messaging trust, UI redress and prototype pollution

AI and LLM apps

Prompt injection, agent and tool abuse, and unsafe output handling for LLM-backed targets

Cloud, supply chain and native code

IAM, infrastructure-as-code, containers, CI and release signing, dependencies, RPC and queues, tenant isolation, memory safety and binaries

What people built with it

@makosamunyaa

Added the skill to Skillshed for Claude Code and Codex installs, then ran it on Skillshed itself. It found a real low-severity bug in their submission bot, which they fixed and tested.

@BowTiedCrow

Ran it against his codebase overnight and says he was genuinely impressed by the results. He calls it the bare minimum you should do.

@dcbuilder

With the skill installed, told his agent to go through recently found CVEs across his tailnet and host machine and patch everything: 50+ packages patched over 25 devices. That goes beyond the skill's own source-audit workflow.

@FrG_FM

Ran it with his Codex account on deployed repos he owns to check his fixes. After 30 minutes Codex showed a "This content can't be shown" cybersecurity notice instead of results.

Cloudflare

Cloudflare started its vulnerability harness from this skill (about 450 lines at first). The harness grew to cover 128 repos and left 7,245 actionable findings for its teams; the blog says a single skill run finds about half the bugs that repeated runs find.

First-hand posts are from their authors on X (found via the X API, Oct 26, 2026). "Official showcase" is Cloudflare's own blog post of June 18, 2026.

How to use it

Check Node.js
The install command uses the Skills CLI, which needs Node.js 22.20 or later. Open a terminal and run:
```
node --version
```
You should see v22.20 or higher. If not, install a current Node.js first.
Install the skill
In the folder of the project you want to check, run:
```
npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit
```
Pick your agent when asked (Claude Code, Codex, Cursor and others). To install it for every project instead, add --global:
```
npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit \
  --global
```
Open your agent in the project
Start your coding agent in the codebase you want to audit, or point it at it.
Ask for an audit
Prompt
```
security audit this codebase
```
Asking for an audit or pen test runs the full six-phase workflow. A plain security question only uses guidance mode and writes no report files.
Read the report
With no folder named, results go to ~/security-audit-skill/<repo-name>/run-<N>. Open REPORT.md first, then FINDINGS-DETAIL.md and NEEDS-VALIDATION.md.
Fix the confirmed findings first. A needs_validation item names the exact fact still missing. It's a starting point, not a guarantee that your app is safe.

Prerequisites

A coding agent with a model that supports tool use and parallel sub-agents (README)
Node.js 22.20+ for the Skills CLI install command (Skills CLI README); the findings and coverage validators also run on Node.js
A repository you own or are allowed to audit
Optional: an OS-enforced sandbox (no network, allowlisted environment, resource limits, writes only to scratch folders) if you want the agent to build or run your code. Without it, leads stay needs_validation
No Cloudflare account is needed

Install for one agent, no prompts

Use -a codex, -a cursor or another agent name from the Skills CLI agent list. -y skips the confirmation prompts.

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit -a claude-code -y

Choose where the report goes

The workflow writes inside your repo only if you pick a folder there that version control ignores. Otherwise it uses a folder outside the repo.

Prompt

do a security review, output to ~/audits/my-project

Audit only part of the code

A scoped run can cover named paths, one subsystem, one attack-class domain or the diff between two source refs. Everything else is recorded as out of scope, never as covered.

Prompt

find security vulnerabilities in ./src

Pick a profile and a budget

Profiles are quick, standard (the default) and deep. A budget is the maximum number of agent invocations; if it can't fund the minimum reconnaissance, critics and verifier, no agent runs and the skill asks you to change it.

Prompt

do a quick security audit of this codebase with a budget of 40 agent calls

Run it again

Runs on the same repo add up: the next run reads earlier ledgers and findings, targets gaps and re-checks changed code. In Cloudflare's tests one run found roughly half of what repeated runs found.

Prompt

security audit this codebase

Check the output files yourself

Both validators are zero-dependency Node scripts in the skill folder. Claude Code project installs live in .claude/skills/; most other agents use .agents/skills/.

node .claude/skills/security-audit/validate-findings.cjs ~/security-audit-skill/my-repo/run-1/findings.json
node .claude/skills/security-audit/validate-coverage-ledger.cjs ~/security-audit-skill/my-repo/run-1/coverage-ledger.json

Keep it updated

There are no tagged releases; updates come from the repo's main branch.

npx skills check
npx skills update security-audit

Gotchas

Your agent must support parallel sub-agents. The skill runs many isolated agents, so a full audit can use a lot of your plan's quota.
It only executes your code inside an OS-enforced sandbox with no network, an allowlisted environment and write limits. Without one, anything that needs running stays needs_validation.
One run is not complete coverage. Cloudflare says a single run found roughly half of what repeated runs found.
One Codex user on X reported a "This content can't be shown" cybersecurity notice after 30 minutes of auditing (Oct 22, 2026).
It doesn't probe live sites, deployed endpoints or production accounts. It is a source-first, defensive review of a repo.
The Skills CLI collects anonymous usage data. Set DISABLE_TELEMETRY=1 or DO_NOT_TRACK=1 to turn it off.

Commands from the official README, SKILL.md and Skills CLI docs, checked Oct 26, 2026.

Before you start

An AI security audit is not a guarantee. Treat findings as leads to check, and run it more than once on code that matters.
The biggest posts came from aggregator accounts. One @RoundtableSpace post holds 4,034 of the 5,716 likes in our 50-post sample, so the reach is concentrated.
The repo was published on June 18, 2026 and has had no commits since Sept 14, 2026. This week's buzz is about code first shared in June, not a new version.
Audit only code you own or are allowed to test. The skill is built for defensive, source-first review and tells the agent not to touch live systems or other people's data.
A full audit runs many sub-agents and can take a long time and use a lot of your agent's quota or API spend.

FAQ

What is Security Audit Skill?

Is it free and open source?

Yes. cloudflare/security-audit-skill is MIT-licensed and needs no Cloudflare account. The cost is your coding agent's usage: a full audit runs many sub-agents on your own plan or API key.

How do I install it?

You need Node.js 22.20+ for the Skills CLI. In your project folder run "npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit", pick your agent, then open the agent and type "security audit this codebase".

Which coding agents does it work with?

The skill is agent-neutral, but the agent must support tool use and parallel sub-agents. The Skills CLI installs it into Claude Code, Codex, Cursor, OpenCode and about 75 other agents.

Does it fix the bugs for me?

No. It reports findings with source evidence, a safe reproduction, a priority and the smallest effective fix, but it doesn't change your code. Applying fixes is up to you.

How many false positives does it give?

The question people ask most on X. Cloudflare publishes no false-positive rate for the skill. Its design is meant to cut them: a fresh agent tries to disprove every candidate, and unproven leads go to needs_validation instead of confirmed. Check findings yourself before acting.

Will it run my code?

Only inside an OS-enforced sandbox with no external network, an allowlisted environment, resource limits and writes limited to scratch folders. Without that, it reads the source only and keeps anything needing execution as needs_validation.

Is this the same as Cloudflare's vulnerability harness?

No. This is the single-repo skill the harness grew from, slightly cleaned up for release on June 18, 2026. The fleet-wide harness, with its database, deduplication and cross-repo tracing, is not in this repo; Cloudflare wrote that it hopes the harness will follow.

How is the Repo of the Week picked?

We feature the GitHub repo most talked about on X that week in AI and vibe coding, counted by distinct authors and engagement, and cross-checked against GitHub Trending. Stats come from the GitHub API and are dated. Security Audit Skill was checked 2026-10-26.

All weeks

Every pick stays here with its own page. Newest on top.

Week 44, 2026This weekOct 26, 2026
Security Audit Skill: Cloudflare's security audit for your coding agent
A free add-on that makes your AI coding agent check your code for security holes, with a second agent double-checking every finding.
cloudflare/security-audit-skill★ 47.4k (at feature time)MITOpen week page →
Week 43, 2026Last weekOct 19, 2026
HyperFrames: write HTML, render video
A free tool that lets your AI coding agent make real videos by writing a web page.
heygen-com/hyperframes★ 67k (at feature time)Apache-2.0Open week page →
Week 42, 20262 weeks agoOct 17, 2026
REA: Reverse Engineer Anything
A free tool that lets your AI coding agent take apart any app to see how it works.
morluto/rea★ 292.8k (at feature time)MITOpen week page →

Security Audit Skill: Cloudflare's security audit for your coding agent

What it is

Who it’s for

What you need

Why it’s trending

What it checks

What people built with it

How to use it

Check Node.js

Install the skill

Open your agent in the project

Ask for an audit

Read the report

Install for one agent, no prompts

Choose where the report goes

Audit only part of the code

Pick a profile and a budget

Run it again

Check the output files yourself

Keep it updated

Gotchas

Before you start

FAQ

All weeks

Security Audit Skill: Cloudflare's security audit for your coding agent

HyperFrames: write HTML, render video

REA: Reverse Engineer Anything

The weekly diff