🔥 Hot Repo: The AI Bug-Hunter Cloudflare Runs on Its Own Code
Cloudflare open-sourced the multi-agent security auditor that powers their internal vulnerability discovery harness — and it works with Claude Code right now.
By OMC Editorial on 2026-10-21
One-liner — A coding-agent skill that coordinates isolated AI agents through a six-phase adversarial security audit, producing schema-validated, machine-readable findings — the same tool that seeded Cloudflare's internal vulnerability discovery harness.
- Repo: cloudflare/security-audit-skillhttps://github.com/cloudflare/security-audit-skill
- Stars: ⭐ 35,155 +1,997 today
- Language: JavaScript / Markdown
- License: MIT
---
What It Does
security-audit-skill turns any capable coding agent — Claude Code, Codex, Cursor — into a multi-phase security auditor. It orchestrates isolated agent instances through six sequential phases: reconnaissance, coverage-led vulnerability hunting per attack class, adversarial candidate validation, schema-validated structured output, independent record verification, and target-neutral reporting. Every confirmed finding requires a complete source trace; without one, it lands in needsvalidation, not confirmed.
Why It's Blowing Up
In June 2026, Cloudflare published "Build your own vulnerability harness"https://blog.cloudflare.com/build-your-own-vulnerability-harness/, revealing that this skill — originally 450 lines — was the seed of a fleet-wide AI security system that can discover, validate, deduplicate findings, and open draft PRs across their entire codebase in roughly 14 hours. The open-source release was intentional: the README states it is "the skill that seeded Cloudflare's vulnerability discovery harness."
Today's +1,997 star spike — a 6% single-day jump at 35K stars — points to renewed attention, likely from a conference talk or follow-up coverage. The adversarial design is what's catching developers' eyes: the agent that validates a finding is never the agent that found it, which systematically eliminates a class of hallucination false positives that plague simpler "ask the model to review this code" approaches.
The skill also covers attack classes most AI code reviewers ignore: AI/LLM prompt injection, supply chain com
More agent news