Cloudflare's security-audit-skill turns a coding agent into a multi-phase security auditor where the agent that checks a finding is never the one that found it.
Yes, Cloudflare security-audit-skill is open source under the MIT license.
Cloudflare security-audit-skill is free to use.
Yes, Cloudflare security-audit-skill can be self-hosted (the source is available under the MIT license).
MIT coding-agent skill from Cloudflare (JavaScript) that turns an agent into a multi-phase security auditor, built on the assumption the agent will hallucinate, so it makes the agent prove everything. Six phases run in order: recon maps the app's architecture and trust boundaries, isolated hunter agents attack from separate angles (injection, access control, business logic, crypto, feature abuse, chained attacks), validation agents try to disprove each finding, and the agent that checks a finding is never the one that found it. Output is machine-readable JSON with independent verification, and it installs through the Skills CLI.
A lot of the GTM stack is now code an agent helped write, and the usual security pass is a single-shot LLM scan that either misses the real bug or drowns you in imagined ones. Cloudflare's skill takes the opposite stance: it assumes the agent is unreliable and designs around it, splitting recon, hunting and validation across separate agents and refusing to let the finder grade its own work. The output is verified, machine-readable findings instead of a wall of maybes. The honest read: this is a skill, not a product, so it rides on a capable coding agent, Node and a real sandbox, and it is early by commit count. But the adversarial, prove-it structure is the right shape for agent-run security work, and coming from Cloudflare it is worth wiring into your review step.