security-audit-skill, an open-source (MIT) skill that Cloudflare published on 18 June 2026 with its blog post "Build your own vulnerability harness", has become one of the fastest-rising repositories on GitHub. The Catch counted 44,639 stars on 25 October, 12,680 of them gained in seven days, which put it at number one on GitHub's weekly trending list. The repository now shows about 56,300 stars and 3,700 forks. According to The Catch and AI Heartland, the workflow was substantially reworked in September.
What it does: it is a set of instructions, not a scanner. It turns a coding agent such as Claude Code or Codex into a security auditor working in six phases: reconnaissance of the architecture and inputs, coverage-led hunting by isolated agents, validation in which a fresh agent tries to disprove each candidate, structured output in findings.json (confirmed, needs_validation or rejected), independent re-verification, and a final report. The agent that finds a bug is never the one that confirms it. By default it runs in a guidance mode that just answers questions. A full audit runs only when you explicitly ask for one.
Requirements: an agent and model that support tool use and parallel sub-agents, Node.js for the bundled validators, and an OS-enforced sandbox for running the target's code. Without a sandbox, findings that would need code execution stay marked needs_validation.
Cloudflare's own numbers: Cloudflare says it started from this roughly 450-line skill and grew it into an internal harness that scanned 128 repositories. That harness produced 20,799 raw candidates, about 12,057 of which survived validation, leaving 7,245 actionable findings. These figures come from the internal harness, not the public skill, and the harness itself had not been released when the post was written. Cloudflare's blog also lists two limits: one run found roughly half of what repeated runs found, and its findings skewed toward simpler bugs. Cloudflare gives no false-negative rate, so a clean run does not mean the code is safe.
