Peaked at #3 Now #3
Cloudflare Open-Sources Agent Security Audit Skill
Cloudflare open-sourced a multi-phase security audit skill letting coding agents scan code and independently verify findings.
Key points
- Cloudflare open-sourced a security audit skill, installable via npx skills add with the security-audit skill, then run by typing "security audit this codebase" in an agent inside the project.
- The skill works in 6 phases: maps the codebase, hunts for bugs area by area, sends each finding to a fresh agent for confirmation, writes structured results, verifies each record again independently, and writes the final report.
- Findings are split into confirmed, needs validation and rejected, and the project is MIT licensed with 31.3K stars.
- Replies note it uses roughly 150 subagents and consumes a lot of tokens; one user said Claude on the 20 Max plan burned a whole week's quota in under 24 hours on a single project.
Key points and the reaction summary are written by AI from the posts on this page. Check the original post. How we use AI
Original post
Top replies on X
Reaction on X: Replies are largely cautionary rather than critical of the skill itself, which several users consider useful. The main additions are that it consumes a lot of tokens and roughly 150 subagents, that it should be run on a clean copy since it reads every .env and key file, and a question about whether it has a real stop condition or just runs until the budget does. The original poster did not respond.
Sign in to see 5 top replies from X
From @nonossystems, @milan_milanovic, @fernandokarl and others. Spam removed, with English and Chinese translations.
Discussion 0
Sign up Sign in to join the discussion
No comments yet. Start the conversation.