security-audit-skill

Sources: GitHub — cloudflare/security-audit-skill · OSS AI Security Harness Comparison.

Identity and role

security-audit-skill is a Claude Code skill published by Cloudflare, placed by Semgrep’s July 2026 survey in the LLM-skill-boosting vulnerability-research category: skills added inside an LLM to make it reason about code the way a human vulnerability researcher would. The survey records about 2K GitHub stars under an MIT licence.¹

Mechanism

Semgrep’s LLM-generated summary describes roughly 1,200 lines of Markdown methodology paired with a zero-dependency Node validator, installed via npx skills add.² The audit runs six phases: reconnaissance; a parallel hunt across eight to twelve or more agents, each assigned an attack class; adversarial validation, where separate agents attempt to disprove each finding; a report phase; a schema-validated findings.json output; and an independent phase-six verification against the source code. The methodology is language-agnostic, with domain playbooks for memory-safety and binary code, AI/LLM systems, web-protocol and authentication issues, and client-side code. It may optionally build and run code to confirm a finding. Output combines a human-readable report with a SARIF-like custom JSON schema carrying payloads and reproduction steps rather than standalone exploits. Semgrep’s summary states the point directly: the intelligence is whatever model hosts the skill, and the skill itself is the methodology.

Deployment shape

As a skill rather than a pipeline, security-audit-skill deploys as a prompt pack inside Claude Code and brings no model calls of its own. It uses the host agent’s model and inherits whatever sandbox the host agent has, running unattended only as far as the driving agent allows.²

Positioning

The Phase 3 adversarial-validation step is one of four named instances of adversarial validation across Semgrep’s comparison, alongside VVAH’s S6, Trail of Bits’ fp-check, and defending-code-harness’s fresh-container grader. Semgrep recommends the skill to a team already working inside Claude Code that wants a rigorous, adversarially-validated audit methodology with near-zero setup and no new infrastructure.

See Also

• Cloudflare — publisher.
• OSS AI Security Harness Comparison — source.
• Semgrep — publisher of the source.

Footnotes

1. Star count as reported by Semgrep in its July 2026 survey; a point-in-time figure. ↩

2. From Semgrep’s LLM-generated summary of the repository, not the survey’s human-written body. ↩ ↩²