Cloudflare's Free Security Audit Skill for Claude Code

security-audit-skill is a free, open source skill from Cloudflare (MIT license, about 28,000 GitHub stars). It seeded the harness Cloudflare uses to find vulnerabilities in its own code. You add it to a coding agent like Claude Code, and the agent audits your codebase for security problems.

What security-audit-skill does for you: it runs a six phase audit. First it maps your app: how it is built, where untrusted input comes in and what it trusts. Then a team of separate agents hunts through the code for bugs, such as holes in logins, your database and your APIs, and prompt injection if your app uses AI. Every bug it finds goes to a fresh agent whose only job is to disprove it. Only the bugs that survive land in the report, each one with how to fix it.

How to install security-audit-skill: copy the repo URL below, paste it into Claude Code, and say: install this.

Or install it by hand with the Skills CLI (you need Node.js):

Best practices for security-audit-skill:

• Start Claude Code inside the project folder you want audited, so the skill reads the right code.
• Run the audit more than once. Cloudflare says one run found roughly half of what repeated runs found in total, and each new run builds on the last one.
• Read the needs_validation list too. Those are leads the agents could not prove or disprove, and they are worth a human look.
• Run it inside a sandbox when your project builds or runs code. The skill asks for one so it never runs untrusted code on your real machine.

Prompts to try with security-audit-skill:

• Pick one project you already shipped, like a vibe coded app with logins and a database, and audit that first.
• Fix the confirmed issues first, then the needs_validation ones, then run the audit again.