Cloudflare’s security-audit-skill turns a coding agent into a multi-agent security auditor through six distinct phases: recon, hunting, validation, reporting, structured output, and independent verification. It started as the seed for Cloudflare’s own vulnerability discovery harness and lives in one repo. Each phase spins up parallel or adversarial sub-agents to map the codebase, probe for injection flaws, access-control bugs, business logic errors, crypto misuses, chained attacks and even wildcard scenarios. Findings get double-checked by separate agents before any report is written. At the end of the run you get three outputs: a human-readable REPORT.md, a detailed FINDINGS-DETAIL.md for medium-and-higher issues, and findings.json validated against report-schema.json via a zero-dependency Node.js script (validate-findings.cjs). Then fresh agents verify each claim against the actual source. The skill skips previously logged issues by reading past findings.json files, so repeated runs explore new paths and improve coverage—tests show a single pass catches about half of total vulnerabilities. You install it with “npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit” (add “--global” for user-level). Point your agent at the target repo and issue commands like “security audit this codebase” or “find security vulnerabilities in ./src.” Requirements are simple: a coding agent that handles tool calls and parallel sub-agents, plus Node.js for schema checks. Principles include only reporting exploitable bugs with concrete attack steps, strict adversarial validation (the finder never validates its own work), and measuring severity by real impact rather than checklist compliance.