Turn a coding agent into a security auditor that finds exploitable bugs — not checklist noise.
security-audit is an agent-neutral skill that orchestrates many parallel sub-agents through a six-phase pipeline — recon, hunting, validation, reporting, structured output, and independent verification — to surface vulnerabilities with real, demonstrable impact. It is the open-source seed that grew into Cloudflare's fleet-wide vulnerability harness.
// What it does
Exploit, don't theorize
Every finding needs a concrete attack: who the attacker is, what they send, and what they get. "An attacker could theoretically…" is not a finding.
Adversarial by design
The agent that finds a bug is never the agent that validates it, and a third fresh agent re-verifies every claim against the source. Bias is cancelled, not trusted.
Severity = impact
Severity is likelihood × impact, not deviation from OWASP. A gap that another layer already blocks is a hardening note, not a vulnerability.
From a skill to a fleet
Cloudflare published this single-repo skill as the starting point for its internal harness. That harness grew into a two-stage, fleet-wide system — a Vulnerability Discovery Harness (VDH) plus a Vulnerability Validation System (VVS) — scanning 128 repositories. The numbers below are from that production system; the skill on this site is the foundation it evolved from.
"The harness is the bit that lasts." Models are swappable components; the orchestration is the durable asset. Start with a skill, get the prompts right, and only build the next stage when not having it is the specific thing slowing you down.
// Explore the skill
Sources
This is an independent, unofficial explainer. Content is distilled from the skill's own files; production metrics are from Cloudflare's engineering blog. Not affiliated with Cloudflare.