Cloudflare's security-audit skill makes your agent prove every bug
Open-sourced from the harness Cloudflare runs on its own code: six phases, hunter agents versus validators, and confirmed/rejected verdicts you can gate CI on.
Copy markdown
One command, MIT, pointed at your repo
Install with `npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit` into any coding agent that supports tool use and parallel sub-agents, then say "security audit this codebase." It runs six phases across Rust, Go, C, Lua, TypeScript, and Python — bring Node for the validators and a sandbox with networking off.
It's built to distrust itself
The whole design assumes the agent hallucinates. Hunter agents propose vulnerabilities, separate validator agents try to disprove them, and only survivors ship as `confirmed` — the rest land as `needs_validation` or `rejected` — while a coverage ledger records what got skipped. That adversarial split is the reusable idea: machine-readable findings you can gate a pipeline on instead of a wall of plausible prose.
It's the public cut of Cloudflare's own harness
This is the skill that seeded Cloudflare's internal vulnerability-hunting harness, now MIT on GitHub and the day's fastest-growing agent skill as the skills layer erupts around it. After a week where agents were the attack surface — the Opus 5 OpenAI account takeover, Plugin4Shell, Gemini's autonomous breach — turning one loose on your own code is the defensive counter-move.
Elsewhere: GLM-5.3-FlashX lands on Vercel's AI Gateway
Z.ai's GLM-5.3-FlashX — 1M context, $0.37/$1.25 per M tokens, up to ~200 tok/s (vendor peak) — is now one API key away on Vercel's AI Gateway, with automatic fallbacks and request traces. It's a faster hosted tier over GLM-5.3-Flash, not a smarter model, and it's API-only with no open weights.