Inside Cloudflare's security-audit-skill: How Multi-Phase Adversarial AI Agents Audit Codebases

When you paste code into a standard AI chat and ask, "Are there any security vulnerabilities here?", the result is almost always disappointing. The model flags missing headers or theoretical checklist items while completely missing multi-file Broken Object Level Authorization (IDOR) or request-framing flaws.

To solve this, Cloudflare open-sourced cloudflare/security-audit-skill—the exact coding-agent skill that seeded Cloudflare's internal vulnerability discovery harness. Within days, the repository crossed 47,000+ stars on GitHub.

Let's examine why naive security prompts fail, how Cloudflare's 6-phase architecture and Adversarial Validation work under the hood, and how to run it on your own repositories in one command.

1. Why Single-Prompt AI Security Reviews Fail

1. Unbounded Coverage Gaps: In a real repository, a single agent skims a few files and loses track of which endpoints and trust boundaries were actually inspected.
2. Confirmation Bias: Once an LLM spots a suspicious-looking function, it tries to justify its suspicion—producing noisy false positives.
3. Confusing Hardening with Vulnerabilities: Without tracing full data flow from entry point to sink, models report defense-in-depth notes as "Critical" bugs.

Cloudflare's security-audit-skill eliminates these anti-patterns by combining isolated sub-agents with deterministic, zero-dependency Node.js validators (validate-coverage-ledger.cjs and validate-findings.cjs).

2. The 6-Phase Security Audit Pipeline

When triggered inside your coding agent, the skill orchestrates six strict phases:

[Phase 1: Reconnaissance] ──▶ Maps architecture & input surfaces into coverage-ledger.json
           │
           ▼
[Phase 2: Coverage-Led Hunting] ──▶ Spawns isolated Hunter sub-agents across 10 attack domains
           │
           ▼
[Phase 3: Candidate Validation] ──▶ Fresh Verifier sub-agent actively tries to DISPROVE each finding
           │
           ▼
[Phase 4 & 5: Structured Output & Verification] ──▶ Validates findings.json against report-schema.json
           │
           ▼
[Phase 6: Target-Neutral Reporting] ──▶ Generates REPORT.md, FINDINGS-DETAIL.md & NEEDS-VALIDATION.md

Phase 1: Reconnaissance & Deterministic Coverage Ledger

Before hunting for bugs, the agent maps your architecture, trust boundaries, and input surfaces into architecture.md and coverage-ledger.json. Every subsequent phase is validated against this ledger so no module is silently skipped.

Phase 2: Specialized Hunter Sub-Agents

Isolated Hunter agents are dispatched across 10 specialized domain playbooks:

• WEB-PROTOCOL-AND-AUTH.md: Request smuggling, web cache poisoning, CSRF, JWT/OAuth/OIDC, and session fixation.
• AI-AND-LLM.md: Indirect prompt injection via RAG/tools, cross-tenant context bleed, and MCP authority escalation.
• DATA-ISOLATION-AND-LIFECYCLE.md: Multi-tenant isolation, IDOR/BOLA, and search/cache leakage.
• SUPPLY-CHAIN-AND-RELEASE.md: CI/CD pipelines, GitHub Actions, and artifact signing.
• MEMORY-SAFETY-AND-BINARY.md: Native C/C++/Rust unsafe memory corruption and race conditions.

Phase 3: Adversarial Candidate Validation

This is the defining engineering rule of the entire project:

Phases 4–6: Schema Validation & Reporting

Every candidate receives one of three strict verdicts in findings.json:

• confirmed: Complete source trace from untrusted input to dangerous sink with bounded local verification.
• needs_validation: Source-grounded lead blocked by an unobservable runtime/proxy/IdP setting (recorded with the exact unresolved fact and no inflated severity).
• rejected: Disproved candidates preserved so future runs don't waste time re-hunting them.

3. Installation & Usage

Install the skill using the Skills CLI:

# Project-level installation
npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit
 
# Or install globally for all repositories
npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit \
  --global

Then start your coding agent in your repository and ask:

security audit this codebase

or specify a target path and output directory:

do a security review, output to ~/audits/my-project