AI-Powered Security Auditing

Turn your coding agent into a security auditor with a multi-phase, independently verified vulnerability discovery system.

11,645
Stars
632
Forks
32
Open Issues
Security Audit Visualization

Six-Phase Security Audit Process

A comprehensive approach to security auditing with independent verification and machine-readable findings

1

Reconnaissance

Map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json

2

Coverage-led Hunting

Assign isolated hunters from ledger units, record their checks, and use coverage critics to find gaps in security coverage

3

Candidate Validation

Give every unique candidate to a fresh verifier that tries to disprove it through adversarial validation

4

Structured Output

Write confirmed, needs_validation, and rejected records to findings.json and validate them against report-schema.json

5

Independent Verification

Fresh agents verify final source claims. Material replacements receive another independent verifier

6

Target-neutral Reporting

Generate REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from verified records and coverage ledger

Quick Installation

Add the security audit skill to your coding agent with a single command. Works with any agent that supports tool use and parallel sub-agents.

Install locally:
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

Install globally:
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit --global

Usage Examples

security audit this codebase

find security vulnerabilities in ./src

do a security review, output to ~/audits/my-project

Design Principles

Built on security-first principles for reliable vulnerability discovery

Boundary-First Confirmation

Only confirm established boundary failures. Keep source-grounded blocked leads as needs_validation with exact unresolved facts.

Adversarial Validation

The agent that checks a finding is never the agent that found it, ensuring unbiased verification of security issues.

Impact-Based Severity

Severity requires impact. Likelihood × impact, not deviation from a checklist, for meaningful risk assessment.

Defense-in-Depth Awareness

Defense-in-depth gaps are not vulnerabilities. If Layer A prevents the attack, the absence of Layer B is a hardening note.

Iterative Improvement

Multiple runs improve coverage. In test runs, repeated runs found twice as many vulnerabilities as single runs.

Structured Reporting

Machine-readable findings with JSON schema validation for integration with security toolchains and workflows.