Radar / AI security / Cloudflare security-audit-skill
Cloudflare security-audit-skill: six-phase agent-driven security audits with independently verified findings
In today's Spotlight · Picked by 4 of 4 modelsChecks software for security flaws and separately tests whether suspected problems are real.Like a second inspector checking the first inspector’s findings.
Open-source MIT coding-agent skill that runs a codebase through six audit phases — reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, reporting.
Why it matters
The skill seeded Cloudflare's own vulnerability-discovery harness; its hunter/verifier split — fresh agents trying to disprove each candidate — attacks the false-positive problem that plagues AI security review.
What you could build with it
A dev-tools team could bundle this skill into a managed pre-release security gate for agent-built projects: run it in CI on every merge to main, surface only confirmed findings with evidence traces, and sell the reviewer time it saves to small teams shipping AI-generated code.
Does it hold up?
Real but expensive: structured audits with independent verification work as advertised, though one community report burned roughly 1M tokens on a medium codebase with zero findings — best suited to serious pre-release audits where reviewer time matters more than token cost.
Built with Cloudflare security-audit-skill
- Cloudflare security-audit-skill: 6 Phases, 25.6k Starsexplainx.ai · In-depth guide to the six phases and Skills-CLI install, noting a reported 1M-token audit run on a medium codebase that surfaced nothing.
- Cloudflare released a coding-agent skill that checks its own security findingsmiketechlife · Overview of the hunter/verifier split and why machine-readable, evidence-checked findings beat single-pass narrative audits.
- 7 Open-Source Tools to Audit Vibe-Coded Projects Before You Shipmedevel · Roundup placing the skill among tools for auditing AI-generated codebases before shipping.
Learn more
First spotted on github: source.
More AI security
iFixAi: independent auditing of AI agentsIndependent AI-agent auditor: 250+ inspections across 69 misalignment categories (red teaming + operational assurance)…security · JEV 0.76OpenAI, Anthropic and Google DeepMind jointly unveil cyber-focused safety models and safeguardsThe three rival labs disclosed weeks of behind-the-scenes coordination and jointly released a set of cyber-focused AI…security · JEV 0.73OpenAI textGrain watermarking for ChatGPT and Codex in the EUOpenAI will roll out its invisible textGrain watermarking system to ChatGPT/Codex users in the EU over the coming…security · JEV 0.65Cloudflare security-audit-skill: multi-phase security audits for coding agentsA coding-agent skill that runs multi-phase security audits with independently verified, machine-checkable findings.security · JEV 0.63LiveNerf: a pre-registered benchmark for post-release model driftOpen-source, pre-registered 30-day benchmark that detects whether Claude Opus 5.5 quietly gets worse after launch.security · JEV 0.61Perplexity SPACE — open-source Firecracker microVM sandbox for AI agentsPerplexity open-sourced SPACE (Sandboxed Platform for Agentic Code Execution), the Rust platform behind every…security · JEV 0.59
Get the week's best AI launches, plus 3 ideas worth building
One email every Saturday. Ranked by traction, not hype. Free.