Cloudflare's Security Audit Skill Uses Six Phases for Full Audits

Cloudflare's security-audit-skill gives coding agents a six-phase process for full codebase audits, with separate validation and machine-readable records that show how findings were assessed.

The process starts by mapping a codebase's architecture, trust boundaries, input surfaces and prior evidence. It records that work in files such as architecture.md and coverage-ledger.json. Isolated agents then examine assigned areas, while coverage critics look for gaps.

Each unique vulnerability candidate goes to a separate verifier that tries to disprove it. The skill records outcomes as confirmed, needs_validation or rejected in findings.json. Independent agents review final claims, with another check for claims that materially change.

The tool generates reports, including REPORT.md and FINDINGS-DETAIL.md, from verified records and the coverage ledger. Repeated audits can use earlier findings to target gaps and recheck changed code.

Developers can install the skill through the Skills CLI and ask a coding agent to audit a codebase.