Cloudflare Security Audit Skill Setup: AI Pen Test Any Repo

Cloudflare's security-audit skill is an MIT-licensed folder of Markdown playbooks plus two zero-dependency Node validators that turns Claude Code, Codex, Cursor or any other sub-agent-capable coding agent into a six-phase security auditor: reconnaissance, coverage-led hunting, adversarial validation, schema-checked findings.json, independent re-verification, and a report with no live-probe instructions. It is the top repo on GitHub trending today with about 3,019 new stars on top of 13,320 total, three months after Cloudflare published it as the seed of its fleet-wide vulnerability harness, and setup takes about five minutes: one npx skills add line, a npx skills list check, then a single sentence to your agent.

• It is prompts, not a scanner: 15 Markdown files (a 22 KB SKILL.md, four core phase guides, ten attack-domain companions), a 14 KB JSON report schema, and two validators with their tests. Nothing runs except your agent and Node.
• Every candidate bug goes to a fresh verifier that tries to disprove it, and the final records get re-verified by yet another agent. Verdicts are confirmed, needs_validation (no severity allowed) or rejected.
• Installs with the skills.sh CLI, which detected Claude Code on our machine and copied the skill into .claude/skills/security-audit non-interactively; global installs go under your home directory instead.
• Two things to know before you start: the validators refuse to run on native Windows (they need O_NOFOLLOW, which Node only exposes on POSIX), and a full audit burns tokens fast. Hacker News commenters this week reported six-figure token counts on small repos.

The exact steps, start to finish

1. Step 1. Check what you already have.

   # Node runs both the installer and the validators; git is used to clone the skill; you need one coding agent that supports sub-agents
   node --version
   npx --version
   git --version
   claude --version

   Ours printed Node v24.17.0. Any recent Node LTS is fine, and the README lists no version floor. If your agent is Codex or Cursor instead of Claude Code, check that binary instead; the installer supports many harnesses and picks up whichever it finds.
2. Step 2. Open a terminal inside the repo you want audited. The skills CLI installs project-level by default, which means the skill lands next to the code it will read. Use cd to the repository root before running anything below.
3. Step 3. Preview the package without installing.

   npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit --list

   This clones the repo and prints Found 1 skill followed by the skill's one-paragraph description. It is a cheap way to confirm you are pointing at the right source before anything is written.
4. Step 4. Install the skill. This is the README's exact line, project-level:

   npx skills add https://github.com/cloudflare/security-audit-skill \
     --skill security-audit

   Add --global for a user-level install that every project can use:

   npx skills add https://github.com/cloudflare/security-audit-skill \
     --skill security-audit \
     --global

   On Windows the backslash continuation does not work; write it on one line. PowerShell and cmd.exe both accept:

   npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

   The CLI asks which agents to install to. When it detects a running agent it skips the prompt; ours printed claude-code Agent detected, installing non-interactively, showed a Security Risk Assessment row (Gen: Safe, Socket: 0 alerts, Snyk: Med Risk) and finished with Installed 1 skill: security-audit (copied). To script it, npx skills --help documents -a claude-code (or -a '*' for every agent) and -y to skip confirmations.
5. Step 5. Verify the files landed.

   npx skills list
   node .claude/skills/security-audit/validate-findings.cjs

   The first prints Project Skills with security-audit, its path, Agents: Claude Code and Source: cloudflare/security-audit-skill. The second, run with no argument, prints Usage: node validate-findings.cjs <path-to-findings.json>, which proves Node can execute the validator. The install also writes a skills-lock.json in the project root recording the source and a content hash. If you used --global, replace .claude/skills with the path npx skills list prints.
6. Step 6. Decide where the audit may write, and whether it may execute code. There is no account, API key or config file for this tool; your agent's own subscription pays for it. Two decisions are yours though. The output directory defaults to ~/security-audit-skill/<repo-name>/run-<N>, outside the target, and the skill will only write inside the repo if you name a directory that version control ignores. And the skill will only build, test or run target code inside an OS-enforced sandbox with no external network, an allowlisted environment, a read-only target and resource limits. Without one, it keeps every lead that needs execution as needs_validation rather than running it. That is the intended behaviour, not a bug.
7. Step 7. Run your first audit. Start the agent in the repo and use one of the README's trigger phrases:

   security audit this codebase

   or narrow it:

   find security vulnerabilities in ./src

   do a security review, output to ~/audits/my-project

   A direct audit or pen-test request enters full audit mode; a security question only gets guidance mode with no files written. If the wording is ambiguous the skill asks one clarifying question first. Expect a long run: the parent agent spawns research agents for reconnaissance, hunters per coverage unit, then verifiers.
8. Step 8. Check the output the way the skill checks itself.

   node <skill-dir>/validate-findings.cjs <output-dir>/findings.json
   node <skill-dir>/validate-coverage-ledger.cjs <output-dir>/coverage-ledger.json

   These are the exact lines from VALIDATION-AND-REPORTING.md. Both must exit 0 before the run counts as complete, and the run writes REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md next to the JSON. Open REPORT.md first: it lists confirmed findings with a source trace, the coverage statement, and what was left unresolved. On macOS, Linux or WSL this works as written; on native Windows see the gotchas below.

What is the security-audit skill and why is it trending?

Cloudflare pushed the repository on June 18, 2026, the same day it published Build your own vulnerability harness, a 21-minute post by Dan Jones, Alexandra Godoi and Grant Bourzikas. The post's origin story is the point of the repo: the team started with a roughly 450-line security-audit skill run on a single repository, tuned the prompts until they surfaced real bugs, and only then built the orchestration that became a fleet scanner covering 128 repos. The skill is that starting point, expanded to 15 Markdown files, a report schema and two validators, and licensed MIT so anyone can run the same playbook inside their own agent.

RelatedBrowserSkill Setup: Give Claude Code Your Logged-In Browser

The design has a few distinctive rules. Only established boundary failures get confirmed: a candidate has to name the lower-trust principal, the input it controls, the control that should have stopped it, the boundary it crosses and the observed result. A missing best practice that no reachable path exploits is a hardening note, not a vulnerability. Severity is likelihood times impact, so needs_validation records carry none. Multiple runs are additive: a second run reads the prior ledger and findings, re-validates anything whose source changed, and targets the gaps. Cloudflare's own test runs found that one pass catches roughly half of what repeated passes find, and the SKILL.md says so out loud rather than pretending one run is enough.

Why the spike this week: the repo hit the front page of Hacker News on September 18 (205 points, 38 comments at the time of writing), the same day a contributor opened issue #39 asking for a cryptography and key-management companion guide, and the skills.sh registry now lists it under cloudflare/security-audit-skill with automated Socket and Snyk assessments on the install screen. The HN thread is also where the sharpest criticism lives, which we cover below.

How do you install the security-audit skill on macOS and Linux?

You need Node (for npx and the validators), git, and a coding agent that supports sub-agents. The README's install lines are the only thing to run:

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit
npx skills list
node .claude/skills/security-audit/validate-findings.cjs

Swap in --global on the first line for a user-level install. The skills CLI symlinks into agent directories by default and copies when it has to (there is a --copy flag to force it); ours reported copied. The installation summary names a canonical .agents/skills/security-audit path with copy → Claude Code under it, but on our machine, with only Claude Code selected, the 20 files ended up in .claude/skills/security-audit and no .agents folder was created, so check npx skills list for the real path rather than assuming. Run npx skills --help for the -a, -s, -y and --copy options if you want to script the install into a dotfiles repo.

How do you install it on Windows?

The install itself is identical, just written on one line. PowerShell:

# PowerShell
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit
npx skills list

# cmd.exe (same commands; npx is a .cmd shim so no shell tricks are needed)
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit
npx skills list

The catch is the validators. On our Windows 10 machine, node .claude\skills\security-audit\validate-findings.cjs findings.json exits 1 with Failed to read findings JSON: OS no-follow and nonblocking input protection is unavailable, and the coverage-ledger validator fails the same way. The source shows why: readFileWithinLimit() refuses to open any input unless fs.constants.O_NOFOLLOW and O_NONBLOCK are non-zero, and Node does not define those flags on Windows. The test suite confirms it, with 22 of 34 findings-validator tests passing and the 7 failures all reporting that same message. The skill text still works, and your agent will still run the phases, but the mechanical gate in phases 4 and 5 cannot pass natively. Run the audit from WSL, or copy findings.json and coverage-ledger.json to a Linux or macOS box for the validation step.

What does the agent actually do in a full audit?

Full audit mode starts by resolving five values: the skill directory, the target root, a stable repo name, an output directory outside the target, and the source ref including whether the worktree is dirty. The parent writes run-metadata.json and is the only writer of the shared files. Every hunter and verifier gets its own agents/<agent-id>/ root with separate scratch/ and artifacts/ directories, and the SKILL.md spends an entire numbered procedure on how the parent promotes files from scratch to artifacts without following symlinks, hard links or changing files. That paranoia is deliberate: the code under audit is treated as hostile to the auditor.

Profiles set breadth without lowering the evidence bar. quick coarsens ledger units, runs one hunter wave and one critic pass, and uses one verifier per candidate. standard is the workflow as written. deep splits units per subsystem and lifecycle mode, runs critic waves until clean, and gives previously covered units a second independent pass. You can also set a budget as a maximum number of agent invocations; the skill reserves critic and verifier calls before it assigns any hunters, and if the budget cannot fund reconnaissance plus reserves it launches nothing and asks for a bigger budget or narrower scope. The ten companion files (memory safety, AI and LLM, web protocol and auth, client-side, supply chain, cloud and deployment, RPC and messaging, resource exhaustion, data isolation, desktop and mobile IPC) are selected during reconnaissance based on what the target is.

How does it compare with Semgrep, CodeQL and Claude Code's built-in security review?

The static tools are still the right thing to run on every pull request: they are cheap, deterministic and fast. The skill is a different instrument, closer to hiring a reviewer who reads the architecture first and argues with themselves before filing anything. Cloudflare's own blog is explicit that it belongs at the start of the maturity curve: get the prompts working in your development environment, and only build a persistent harness when running the skill ten times and diffing by hand becomes the thing that slows you down.

RelatedECC Setup: Install the Claude Code Agent Harness in 10 Minutes

What are the gotchas before you rely on it?

Token spend. This is the loudest complaint on Hacker News. One commenter said they burned about a million tokens on a medium codebase for nothing, another spent at least 150,000 on a small FastAPI project before hitting session limits, and a third called dumping so many schemas into the prompt lazy design, which a Cloudflare team member answered by saying consolidation is being worked on. Start with quick or a scoped run on one subsystem or one PR, and set a budget.

No sandbox, no execution. The skill will not build or run target code unless every listed control is enforced: no external network, an allowlisted empty environment, a read-only target with writes only to scratch/, and CPU, memory, process and wall-clock limits. Without that it reports the lead as needs_validation with a blocker. If you expected proof-of-concept exploits from a laptop run, read that section of the SKILL.md first.

Windows validators. Covered above: native Windows cannot pass the mechanical validation gate. Use WSL or a Unix box for phases 4 and 5.

Model refusals. One HN commenter who does this professionally noted that framing a task as security research can trip model refusals and that they split bug-class analysis out without the security framing. Cloudflare's skill keeps the framing and is defensive and source-first by design, so if your agent balks, that is the harness's policy layer, not the skill.

Prompts, not code. Because nothing here is executable except the validators, the quality of a run tracks the model and harness you point it at. The 2026-06-18 blog post is direct that different models find different shares of the bugs and recommends swapping models between discovery and validation. The skill gives you the structure to do that; it cannot do it for you.

Our take

The most useful thing about this repo is not any single attack prompt, it is the refusal to let the model grade its own homework. A hunter finds, a different agent disproves, a validator checks the JSON against a schema, and a third agent re-reads the source before the report is written. That is the same shape as a good human security review, and it is exactly the discipline that most "ask the AI to find bugs" workflows skip. Install is genuinely one line, the skills CLI's non-interactive agent detection worked first time for us, and the output contract means you can feed the results into anything that reads JSON. The costs are real: a full standard run is a lot of tokens, native Windows cannot finish the validation gate today, and without a sandbox you get a source-only audit with a queue of unresolved leads. Run it scoped, run it from a Unix shell, and treat needs_validation as a to-do list rather than a disappointment. Do that and it is the best free structure we have seen for turning a coding agent into a reviewer you can argue with.

Original analysis by GenZTech. Tool documentation: cloudflare/security-audit-skill on GitHub.