Cloudflare has open sourced the security audit skill that seeded its internal vulnerability discovery harness. MIT licensed, past 5,500 stars in about three months.
It is not a scanner. It is a skill, a folder of structured instructions a coding agent loads and follows. You point Claude Code, Codex or Cursor at a repo, ask for a security audit, and it runs a fleet of isolated sub-agents through six phases.
The security part is good. The part worth stealing is one line in the design principles.
The agent that checks is never the agent that found it
Anyone who has asked a model to review its own output knows why this matters.
A model that just spent 4,000 tokens arguing a piece of code is vulnerable is primed to keep agreeing with itself. Ask it to double check and it checks in a way that confirms. You do not get verification, you get a second draft of the same opinion, written with more confidence because now it has "checked".
Most projects paper over this with a prompt that says "be critical". This one removes the option. The verifier is a separate agent, spawned fresh, with no memory of the hunt that produced the candidate. It cannot be primed by reasoning it never saw.
That is architecture instead of instruction, and it is the difference between hoping for rigour and enforcing it. If you build agent pipelines of any kind, copy this. Whenever one agent produces a judgement and another validates it, the validator should start cold.
Three verdicts, and the middle one earns its place
Most scanners give you a finding or silence. This gives three states:
| Verdict | Meaning |
|---|---|
confirmed |
Complete source trace, bounded observed result |
needs_validation |
Real lead, one exact unresolved fact, no severity |
rejected |
Disproved by a verifier, kept on the record |
needs_validation is where an honest system puts work it could not finish. A tool that only emits confirmed or nothing has to make a silent call on every borderline case, and you never learn which ones it dropped. Here the unfinished work is visible and carries no severity, so it cannot inflate a report beyond what the evidence supports.
Keeping rejected matters too. Re-runs do not burn another fleet of agents rediscovering the same dead end.
I wrote up the full thing, all six phases, the coverage ledger, the attack class library, and the OS-level sandbox requirement most people will skip: Cloudflare's Security Audit Skill: an AI auditor built to disprove itself.
Two things I keep open while reading agent output: a JWT decoder for auth findings, and JSON compare for diffing findings between runs, which is how you see what a second audit actually added.
Top comments (0)