Agent skill · security · aradotso
cloudflare-security-audit-skill
Multi-phase AI security audit orchestration that finds exploitable vulnerabilities through parallel agents, adversarial validation, and machine-readable findings
Why this skill is useful
Adds a multi-phase security audit orchestration with executable scripts for vulnerability discovery that aren't available in public documentation.
What it needs
Requires skills-cli installed locally. About 8k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
cloudflare-security-audit-skill Skill by ara.so — Security Skills collection. A coding-agent skill that orchestrates multi-phase security audits through parallel agents. It runs six phases: reconnaissance, hunting, adversarial validation, reporting, structured output generation, and independent verification. Designed to find exploitable vulnerabilities with real impact, not theoretical issues. This is the open-source skill that seeded Cloudflare's vulnerability discovery harness. Multiple runs against the same codebase are additive—each explores different attack surfaces while reading prior findings to avoid duplicates. What it does The skill coordinates multiple parallel agents through a structured pipeline: 1. Recon — Maps architecture, trust boundaries, input surfaces → architecture.md 2. Hunt — 7 parallel agents attack from different angles (injection, access control, business logic, crypto, feature abuse, chained attacks, wildcard) 3. Validate — Separate agents adversarially review each finding to eliminate false positives 4. Report — Generates REPORT.md and FINDINGS-DETAIL.md 5. Structured output — Produces findings.json validated against report-schema.json 6. Independent verification — Fresh agents verify every claim against actual source code Installation Install using the Skills CLI: For user-level installation (available across all projects): Check installation: Usage Basic audit Navigate to the codebase you want to audit and invoke: The skill activates on trigger phrases and prompts for an output directory if not specified. Specify output directory Default output location: ~/security-audit-skill/<repo-name>/run-<N> Target specific directories Multi-run strategy Run multiple audits for better coverage (each explores different paths): The skill reads prior findings.json files to skip known issues and target unexplored areas. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/cloudflare-security-audit-skill