Cloudflare security-audit skill

A source-first security audit you run inside a coding agent, with separate agents to hunt and to check each finding.

Last updated Oct 14, 2026

Free tierCode scanning

Price: MIT, no separate fee
Free tier: Yes
Checks: Source
Last verified: Oct 14, 2026
Site: https://github.com/cloudflare/security-audit-skill

What the public pages say

This is a skill for a coding agent, not a hosted scanner. The README describes six phases: reconnaissance, coverage-led hunting, candidate validation, structured findings, an independent check of those records, and a report derived from the verified records. The agent that checks a finding is not the agent that found it.

Install it with the command in the README: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit. The same README says to run npx skills --help for agent selection. That help text, read on 2026-10-14, includes --agent claude-code in its examples. The skill file itself says it is agent-neutral and does not name Claude Code.

Free tier

The repository README licenses the skill as MIT and does not list a price. The SKILL.md cost section counts spend as agent invocations: one coverage unit is about one hunter assignment, and a surviving candidate is one or two verifier assignments. A full audit refuses to start if the budget cannot cover reconnaissance plus reserved critic and verifier calls.

Left off the vendor's site

A dollar price or a named credit balance. The skill file talks about a budget of agent invocations, not a fee.

Sources

Listed on ShipSecurely

Put this on Cloudflare security-audit skill's site. The image links back to this page.

<a href="https://shipsecurely.dev/tools/cloudflare-security-audit-skill"><img src="https://shipsecurely.dev/badge.svg" width="196" height="32" alt="Listed on ShipSecurely"></a>

Markdown version · Canonical page: https://shipsecurely.dev/tools/cloudflare-security-audit-skill