Cloudflare Open-Sources the 6-Phase Security Audit Agent Its Engineers Use
Cloudflare has open-sourced the AI security audit agent its own engineers use to review production code. The tool, released as cloudflare/security-audit-skill on GitHub, runs a structured six-phase review that goes beyond static analysis to produce a list of verified vulnerabilities rather than a list of flags.
Six Phases
The agent operates in sequence across six defined phases: reconnaissance (mapping codebase structure), coverage-led hunting (identifying candidate vulnerability patterns), candidate validation (confirming exploitability), structured output (machine-readable JSON generated from confirmed findings), independent record verification (checking that the structured output accurately reflects what the agents found), and target-neutral reporting (human-readable summary).
The distinction from standard static analysis is the adversarial validation step. Static analyzers flag patterns and hand off triage to humans. The Cloudflare agent requires a candidate to prove exploitable before it makes it into the output. Engineers receive a shorter list of higher-confidence findings.
Single-Repo Focus
The open-source release operates on a single repository at a time. Cloudflare’s internal harness extends this into a multi-repo, fleet-wide workflow, but that broader system is not part of what was published. The public tool is the foundational skill, not the full pipeline.
Two-Minute Setup
The tool is packaged as an agent skill composed of markdown instructions and schemas, not a standalone binary with complex dependencies. Setup is minimal: install it inside a coding agent like Claude Code, Cursor, or Codex and point it at a repository. Third-party walkthroughs put installation time at roughly two minutes; the multi-phase audit itself runs longer.
That positioning matters for adoption. Most security tools have complex installation requirements that create friction for one-off use. A skill that slots into a developer’s existing coding agent is more likely to actually get used.
Why Release It
Cloudflare has a pattern of releasing internal tooling publicly — Workers, D1, and its open-source platform releases follow the same logic. The security audit skill is both a genuine contribution and a product signal: a company that operates one of the world’s largest network edges publishing its internal vulnerability workflow is a credibility move for its agent and developer ecosystem.
The release also follows a sequence of AI-powered security tools from major infrastructure companies. OpenAI open-sourced a security CLI earlier this year. Anthropic released a Claude-based codebase scanner. Cloudflare’s contribution is model-agnostic at the infrastructure level — the skill runs inside whatever coding agent the developer already uses, routing calls through that agent’s configured model rather than locking to a specific backend.