Cloudflare's Security Audit Skill: Check Your AI-Built App for Holes
Install Cloudflare's free security audit skill, point Claude Code at your app and get a report of the holes that are actually real.
Back to all free guidesIn the reel I showed the skill Cloudflare open sourced that turns Claude Code into a security auditor. If you've built an app with AI and nobody's checked it, this is the setup, the one line that starts it and how to read what comes back. You don't need to know anything about security to run it.
What it does, in a minute
- It maps your app first. Where data comes in, where the logins are and which parts trust each other, written to
architecture.md. - Every part gets its own agent. Separate hunters go through logins, customer data and, if your app uses AI, prompt injection.
- A second agent tries to prove each bug wrong. The agent that checks a finding is never the one that found it, so bugs that aren't really there get thrown out.
- What survives goes in the report. Each confirmed issue says where it sits in your code and what the smallest fix is.
- It's open source. MIT licence, over 71,000 stars on GitHub, and it's the starting point Cloudflare grew their own bug hunting system from.
Before you start
- A coding agent that can run sub-agents. Claude Code works. You pay for the agent and its model as normal, and the skill itself is free.
- Node.js. The skill uses it to check its own findings files. Type
node --versionin your terminal to see if you have it. - A sandbox if you want it to run your code. It only runs your app's code inside one with the internet switched off. Without one, it still reads everything, it just leaves those leads marked as needs validation.
Install it
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-auditAdd --global to the end if you want it in every project, not just this one.
Run your first audit
Open Claude Code in the project you want checked and say:
security audit this codebaseThat's it. The skill picks up the request and works through the whole thing on its own. Want to check one folder, or save the report somewhere specific? These work too:
find security vulnerabilities in ./src
do a security review, output to ~/audits/my-projectReading the report
Unless you name a folder, everything lands in ~/security-audit-skill/<repo-name>/run-<N>.
REPORT.mdis the one to start with. It has a table of every confirmed issue by severity, then each one with where it sits in your code and the smallest fix.FINDINGS-DETAIL.mdgoes deeper on the medium, high and critical ones, with the full path through your code and how to test the fix.NEEDS-VALIDATION.mdlists the leads it couldn't prove either way, each with the exact thing it still needs to check.findings.jsonholds the same findings in a file another tool can read.
The fixes are suggestions. It doesn't change your code, so you (or Claude Code) make each one yourself.
Run it more than once
Cloudflare's own test runs found a single run catches roughly half of what repeated runs find in total. Runs on the same repo build on each other, so the second one goes after the gaps the first one left. Run it again after you've fixed the first batch.
The full README is worth a skim before your first run: github.com/cloudflare/security-audit-skill. Cloudflare's write-up of how they grew it is here: Build your own vulnerability harness.