Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
security-audit-skill — A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings | Kitploit
Tools/GitHubGitHub/cloudflare/security-audit-skill
Static AnalysisVulnerability AnalysisCode AnalysisDynamic Code Analysis (DAST)Web SecurityPenetration TestingLearning & Education
GitHubcloudflare/security-audit-skill

security-audit-skill

A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings

View Repository
2.8k216572 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

security-audit

A coding-agent skill that turns your agent into a security auditor. It orchestrates multiple parallel agents through a six-phase pipeline -- recon, hunting, validation, reporting, structured output, and independent verification -- to find exploitable vulnerabilities with real impact.

This is the skill that seeded Cloudflare's vulnerability discovery harness, described in Build your own vulnerability harness. The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.

What it does

The skill runs a structured audit in six phases:

  1. Recon -- parallel research agents map the application's architecture, trust boundaries, and input surfaces. Produces architecture.md.
  2. Hunt -- parallel general agents attack the codebase from different angles (injection, access control, business logic, cryptography, feature abuse, chained attacks, and a wildcard). Each agent can spawn sub-agents to dig deeper.
  3. Validate -- separate agents try to disprove each finding. Adversarial review kills false positives.
  4. Report -- produces REPORT.md (human-readable) and FINDINGS-DETAIL.md (detailed traces for MEDIUM+ findings).
  5. Structured output -- writes findings.json conforming to , validated by .
report-schema.json
validate-findings.cjs
  • Independent verification -- fresh agents verify every factual claim in the structured output against the actual source code.

    • Multiple runs against the same repo are additive. Each run explores different code paths; the skill reads prior findings.json files to skip known issues and target gaps.

    Files

    FilePurpose
    SKILL.mdSetup, core principles, platform terminology, workflow overview, and audit anti-patterns
    RECONNAISSANCE.mdPhase 1 reconnaissance prompts and synthesis instructions
    HUNTING.mdPhase 2 orchestration, hunting methodology, and validation rules
    ATTACK-CLASSES.mdCore, wildcard, and obvious-things attack prompts
    MEMORY-SAFETY-AND-BINARY.mdMemory-safety, binary, and kernel hunting classes for native targets
    AI-AND-LLM.mdPrompt-injection, agent/tool, and output-handling hunting classes for LLM-backed targets
    WEB-PROTOCOL-AND-AUTH.mdHTTP request-framing, cache, and authentication-protocol hunting classes for HTTP-protocol and auth targets
    CLIENT-SIDE.mdDOM-injection, messaging-trust, UI-redress, and prototype-pollution hunting classes for client-side/browser targets
    VALIDATION-AND-REPORTING.mdPhases 3–6 validation, reporting, and verification
    report-schema.jsonJSON schema for findings.json (confirmed and rejected finding structures)
    validate-findings.cjsZero-dependency Node.js validator that checks findings.json against the schema

    Installation

    Install the skill with the Skills CLI:

    root@kitploit:~
    npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit

    Use --global for a user-level installation:

    root@kitploit:~
    npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit \
  --global

    Run npx skills --help for agent-selection and non-interactive options.

    Usage

    Start your coding agent in (or pointed at) the codebase you want to audit, then ask it to do a security audit:

    root@kitploit:~
    security audit this codebase
    root@kitploit:~
    find security vulnerabilities in ./src
    root@kitploit:~
    do a security review, output to ~/audits/my-project

    The skill activates automatically when the request matches its trigger (security audit, find vulnerabilities, pen-test the code, etc.). It will ask for an output directory if you don't specify one, defaulting to ~/security-audit-skill/<repo-name>/run-<N>.

    Requirements

    • A coding agent with a model that supports tool use and parallel sub-agents
    • Node.js (for validate-findings.cjs schema validation in Phase 5)

    Design principles

    • Only report what you can exploit. Every finding needs a concrete attack scenario, not "an attacker could theoretically..."
    • Adversarial validation. The agent that checks a finding is never the agent that found it.
    • Severity requires impact. Likelihood x impact, not deviation from a checklist.
    • Defense-in-depth gaps are not vulnerabilities. If Layer A prevents the attack, the absence of Layer B is a hardening note.
    • Multiple runs improve coverage. Testing shows a single run finds roughly half the total vulnerabilities across multiple runs.

    Contact

    Questions, feedback, or comparing notes on AI-driven security tooling: [email protected]

    License

    MIT -- see LICENSE.

    Download Tool