Cloudflare's security audit skill has shot up on GitHub over the past week: as of November 13, 2026, the Cloudflare open-source project has about 71,224 stars and 4,736 forks, adding roughly 11,507 stars in the week of November 12, 2026 alone, making it one of the fastest-growing repositories on GitHub that week. The repository was created on June 18, 2026, under the MIT license. It is not a scanner that produces a report with one click.
What tool is it, and who is it for?
It is a skill for coding agents: a set of Markdown instructions plus two zero-dependency validation scripts. Once installed, tell a coding agent to look at a codebase with the words "security audit this codebase" and the skill activates on that trigger phrase, running an audit in six phases. In the reconnaissance phase it maps the architecture and trust boundaries and records a coverage checklist; in the coverage hunting phase, isolated hunters search for vulnerabilities in parallel; in the candidate validation phase, a fresh validation agent tries to disprove each finding; in the structured output phase, conclusions are written to findings.json as confirmed, needs_validation, or rejected, and checked against a schema; in the independent review phase, another agent verifies the source-code evidence behind every conclusion; finally, a neutral report is produced, including REPORT.md.
Three requirements to see clearly before installing
First, you need a coding agent that supports tool calls and can spawn parallel sub-agents — without one, the skill will not run. Second, you need Node.js to run the validation scripts, plus an OS-level sandbox: no outbound network access, limited resources, and writes only to a designated temporary directory. Without a sandbox, leads that involve executing the target code are parked as needs_validation instead of being run directly. Third, a single audit covers only about half of the vulnerabilities; run it several times and use the history checklist to fill the gaps. It also does not fix vulnerabilities — it only produces evidence-backed conclusions, and fixing them still falls to a person or another tool. Installation is a single command: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit, and you can add --global to install it at user level. A similar idea is OpenAI's Codex Security, which takes a productized route with the cs command line and a plugin — a different implementation.
Who it suits, and who it does not
For developers and small teams who already have a coding-agent workflow and want regular checkups for their own codebase, installing it pays off: the cost is mainly the effort of running the agent and setting up a sandbox, in exchange for a repeatable, reviewable audit process. It does not suit non-technical users who just want a report at one click, nor should it be used as the sole evidence for a compliance audit — its conclusions are engineering material for a development team, not a compliance endorsement.
