Cloudflare’s Security Audit Skill Gains 2,088 Stars in 24 Hours on GitHub

News

Cloudflare’s open-source security-audit-skill surged on GitHub, reaching 65,281 stars. The tool enables multi-phase security audits with machine-readable findings.

On November 7, 2026, Cloudflare’s open-source repository cloudflare/security-audit-skill experienced a significant surge in popularity on GitHub Trending. The project gained 2,088 stars in just 24 hours, bringing its total to 65,281 stars and 4,239 forks. Written in JavaScript, the skill is designed to enable multi-phase security audits with independently verified, machine-readable findings.

Key Features of the Security Audit Skill

The security-audit-skill operates as a coding-agent enhancement, transforming agents into comprehensive security auditors. It executes a structured six-phase process:

1. Reconnaissance: Maps architecture, trust boundaries, input surfaces, and prior evidence, producing outputs such as architecture.md and coverage-ledger.json.
2. Coverage-led Hunting: Assigns isolated hunters to identify gaps and record checks, leveraging coverage critics for thorough analysis.
3. Candidate Validation: Ensures unique candidates are tested by independent verifiers to disprove vulnerabilities.
4. Structured Output: Categorizes findings into confirmed, needs_validation, and rejected, storing results in findings.json and validating against report-schema.json.
5. Independent Record Verification: Deploys fresh agents to verify claims, with material replacements undergoing additional independent checks.
6. Target-neutral Reporting: Generates reports such as REPORT.md and FINDINGS-DETAIL.md from verified records and coverage ledgers.

The tool’s additive approach allows multiple audits of the same repository, targeting gaps, revalidating changes, and maintaining evidence continuity without considering unresolved work as complete.

Installation and Usage

Developers can install the skill using the Skills CLI:

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit

For user-level installations, the --global flag can be added. Once installed, the skill can be activated by initiating a security audit within the desired codebase:

security audit this codebase

The tool outputs findings to specified directories, enabling developers to identify and address vulnerabilities efficiently.

Broader Impact and Momentum

The security-audit-skill has become a critical resource for developers seeking automated, reliable security auditing capabilities. Its rapid growth on GitHub reflects its utility and adoption within the developer community. Originally derived from Cloudflare’s vulnerability discovery harness, the skill offers a streamlined entry point for comprehensive security audits.