Frequently Asked Questions

security-audit-skill is a coding-agent skill that turns your AI agent into a powerful security auditor. It orchestrates a multi-phase security audit process with independently verified, machine-readable findings. This skill was the foundation for Cloudflare's vulnerability discovery harness and provides a structured methodology for comprehensive security analysis.

This skill is designed for security professionals including:

• Enterprise Security Teams: For comprehensive auditing of large codebases with complex architectures.
• Penetration Testers: To conduct systematic vulnerability discovery with a structured methodology.
• DevSecOps Engineers: To integrate security audits into CI/CD pipelines for continuous monitoring.
• Application Security Teams: For web, mobile, and desktop application vulnerability assessment.
• Cloud Security Professionals: To audit infrastructure, containers, and serverless deployments.
• Supply Chain Security Experts: For dependency, CI, and release pipeline vulnerability scanning.

Getting started is simple:

1. Ensure you have a compatible coding agent with tool use and parallel sub-agent capabilities
2. Verify you have Node.js installed for the zero-dependency validation tools
3. Set up an OS-enforced sandbox for target-controlled processes
4. Start your coding agent in the codebase you want to audit
5. Issue a security audit command like "security audit this codebase" or "find security vulnerabilities in ./src"

The skill will automatically activate when it detects a security audit request and guide you through the six-phase process.

The security-audit-skill offers several key features:

• Multi-Phase Auditing: A structured six-phase process from reconnaissance to independent verification.
• Coverage-Led Hunting: Intelligent gap detection using coverage critics to identify missed vulnerabilities.
• Independent Verification: Adversarial validation where different agents check findings for unbiased results.
• Structured Output: Machine-readable findings with distinct verdicts: confirmed, needs_validation, and rejected.
• Incremental Auditing: Multiple runs are additive, targeting gaps and revalidating changed source.
• Target-Neutral Reporting: Comprehensive reports derived from verified records and coverage ledger.

The audit process consists of six distinct phases:

1. Reconnaissance: Maps architecture, trust boundaries, input surfaces, and coverage in structured documentation.
2. Coverage-Led Hunting: Assigns isolated hunters from ledger units, records checks, and identifies security gaps.
3. Candidate Validation: Gives each unique candidate to a fresh verifier that attempts to disprove it.
4. Structured Output: Writes confirmed, needs_validation, and rejected records to findings.json with schema validation.
5. Independent Verification: Fresh agents verify final source claims, with material replacements receiving additional verification.
6. Target-Neutral Reporting: Generates comprehensive reports from verified records and coverage ledger.

The skill produces three distinct verdict types in the findings:

• Confirmed: Has a complete source trace and bounded observed result, indicating a verified vulnerability.
• Needs Validation: Has an exact unresolved fact and no severity, indicating a potential issue that requires further investigation.
• Rejected: Records a disproved candidate, indicating a false positive that has been thoroughly tested and eliminated.

This system ensures that only established boundary failures are confirmed, while keeping source-grounded blocked leads as unresolved with exact facts.

To use security-audit-skill effectively, you need:

• Coding Agent: An agent with tool use and parallel sub-agent capabilities
• Node.js Runtime: Required for the zero-dependency findings and coverage validation tools
• OS Sandbox: An OS-enforced sandbox for target-controlled builds, tests, processes, browsers, emulators, fuzzers, and fixtures. It must disable external networking, use a sanitized allowlisted environment, enforce resource limits, and allow writes only to assigned scratch paths.

The sandbox is critical for security - without proper controls, the workflow will mark findings as "needs_validation" instead of executing target code.

Data security is paramount in the audit process:

• Isolated Agents: Each phase runs in isolated environments to prevent cross-contamination
• Sandboxing: Strict OS-enforced sandboxes contain all target code execution
• Network Controls: External networking is disabled during target code execution
• Resource Limits: CPU, memory, and disk usage are constrained to prevent abuse
• Write Restrictions: Target processes can only write to assigned scratch paths
• Environment Sanitization: Only allowlisted environment variables are available to target code

These controls ensure that the audit process itself cannot be used as an attack vector while thoroughly examining the target code.

The skill includes comprehensive hunting classes for various attack vectors:

• Core Attacks: Fundamental vulnerabilities and common security issues
• Memory Safety: Buffer overflows, use-after-free, and memory corruption issues
• AI/LLM Security: Prompt injection, agent/tool manipulation, and output handling
• Web Protocols: HTTP request framing, cache issues, and authentication protocol weaknesses
• Client-Side: DOM injection, messaging trust issues, UI redress, and prototype pollution
• Supply Chain: Dependency vulnerabilities, CI issues, and release pipeline weaknesses
• Cloud Security: IAM issues, infrastructure-as-code problems, container and serverless vulnerabilities
• Protocols & Messaging: RPC, serialization, queue, broker, and streaming protocol issues
• Resource Exhaustion: Shared resource problems, quota bypasses, and availability attacks

Multiple audit runs are additive and intelligent:

• Prior Knowledge: The skill uses prior ledgers and findings to target new gaps
• Change Detection: Automatically revalidates source code that has changed since the last run
• Evidence Carry-Forward: Maintains current-source evidence without treating stale or unresolved work as covered
• Progressive Coverage: Each run builds upon previous coverage, finding approximately half of total vulnerabilities in the first run and the remainder in subsequent runs

This approach allows for iterative security improvements and continuous monitoring of code changes.

The skill generates comprehensive, structured output:

• Documentation Files: Architecture maps, coverage ledgers, and hunting methodology guides
• Machine-Readable Findings: JSON files with confirmed, needs_validation, and rejected records
• Validation Tools: Zero-dependency validators for findings and coverage ledgers
• Final Reports: Target-neutral reports including:

The main report artifacts are REPORT.md (executive summary), FINDINGS-DETAIL.md (detailed technical analysis), and NEEDS-VALIDATION.md (items requiring further investigation).

We offer several support channels:

• Email Support: Contact us at security-ai-research@cloudflare.com for questions, feedback, or to discuss AI-driven security tooling
• Documentation: Comprehensive guides on setup, core principles, workflow overview, and audit anti-patterns
• Community: Connect with other security professionals using the skill
• Validation Tools: Built-in validators help ensure the integrity of your audit results

We're committed to helping you implement effective security auditing in your organization and welcome feedback on improving the tool.

The skill is built on several key security principles:

• Confirmation-Only: Only confirms established boundary failures; keeps source-grounded blocked leads as needs_validation
• Adversarial Validation: The agent that checks a finding is never the agent that found it
• Impact-Based Severity: Severity requires impact (likelihood x impact), not just deviation from a checklist
• Defense-in-Depth Realism: Defense-in-depth gaps are not considered vulnerabilities if primary controls prevent the attack
• Continuous Improvement: Multiple runs improve coverage and identify more vulnerabilities over time

These principles ensure the skill provides practical, actionable security findings rather than theoretical or checklist-based results.

While security-audit-skill can be a valuable part of your compliance efforts, it's important to understand its role:

• Audit Trail: The skill generates structured output with detailed findings and verification records
• Documentation: Comprehensive reports provide evidence of security testing activities
• Machine-Readable Results: JSON outputs can be integrated with compliance tracking systems
• Not a Compliance Tool: The skill focuses on technical security analysis rather than compliance framework mapping

Many organizations use the skill as part of their broader security and compliance programs, but it should be supplemented with appropriate compliance-specific tools and processes.

The skill is designed to be target-neutral and can audit codebases in various programming languages and frameworks:

• Language Agnostic: The audit methodology focuses on security principles rather than specific language syntax
• Framework Coverage: Includes hunting classes for common web frameworks, mobile frameworks, and desktop applications
• Protocol Independent: Can audit various protocols including HTTP, RPC, messaging, and custom protocols
• Environment Versatility: Works with web applications, mobile apps, desktop software, cloud services, and embedded systems

The reconnaissance phase identifies the specific technologies in use, allowing the skill to apply the most relevant hunting classes and validation techniques.

The skill operates in two modes depending on your request:

• Full Audit Mode: Triggered by direct requests like "security audit this codebase" or "find security vulnerabilities in ./src". This mode runs the complete six-phase audit process and generates all report artifacts.
• Guidance Mode: Triggered by specific security questions or focused vulnerability work. This mode provides targeted guidance and analysis without running the full audit process, unless you explicitly request report artifacts.

Full audit mode is comprehensive but resource-intensive, while guidance mode is more efficient for specific security questions and can be used interactively during development.

Yes, the skill can be integrated into CI/CD pipelines for automated security testing:

• Automated Audits: Run security audits as part of your build or deployment process
• Incremental Testing: Use the skill's incremental auditing capabilities to focus on changed code
• Structured Output: Machine-readable findings can be parsed by CI systems for pass/fail criteria
• Report Generation: Automatically generate security reports for each build
• Resource Management: Configure appropriate sandbox settings for your CI environment

Many DevSecOps teams use the skill to catch security issues early in the development lifecycle, reducing the cost of remediation.