Open sourceJavaScript · ≈52k stars · MIT
Cloudflare Security Audit Skill
Cloudflare's skill for multi-phase security audits with independently verified findings.
Cloudflare's official coding-agent skill for structured security audits. It runs in phases: recon, hunting, then validation by a separate checker, so the agent that finds an issue is not the one that confirms it. Findings come out machine-readable. Install it with npx skills.
Pros & cons
Each point cites its sources and says what kind of evidence backs it. A second reviewer tried to refute every claim before it was kept.
Pros
- DocsRuns a multi-phase audit (recon, coverage-led hunting, validation, schema-checked findings, independent record verification, reporting) in which validators are separate from finders.[1]
- DocsIt is the single-repo starting point of the fleet-wide vulnerability harness Cloudflare describes on its blog.[1][2]
- Independent testIn a third-party blind comparison on one seeded target (n = 3 rounds), median precision was about 90% with zero hits on decoys.[1]
- DocsFindings land in `findings.json` and are validated against a JSON schema with a zero-dependency validator.[1]
Cons
- Independent testIt is expensive: the same comparison measured a median $29.95 per quick-profile run versus $2.06 for a plain single-agent review, with identical recall (0.467) on that target.[1]
- Independent testIt has no advisory or CVE grounding by design, so it found 0% of a disclosed CVE in a pinned dependency.[1]
- DocsSafe use requires an OS-enforced sandbox with external networking disabled and writes restricted, which most dev setups lack.[1]
- User reportsOpen issues report validator CLIs unable to read input on Windows, Antigravity killing parallel subagents, and a target-controlled repo name driving the output path.[1][2][3]
- DocsCloudflare's own runs found a single run catches roughly half of what repeated runs find.[1]
- Best for
- Security teams auditing their own codebases who want verified, low-false-positive findings and can sandbox the agent.
- Watch out for
- Budget for several costly runs and pair it with a dependency/CVE scanner; the cost comparison came from a reviewer who also runs a competing pipeline.
Assessed Oct 29, 2026 · adversarially reviewedSuggest a correction
Neighbours on the workbench
JavaScript · ≈292k stars · MIT
affaan-m/ECC
Agent harness performance optimization system: skills, instincts, memory and security for coding agents.
Maintained by Affaan Mustafa
TypeScript · ≈27k stars · MIT
promptfoo/promptfoo
Test your prompts, agents and RAG — plus red-teaming.
Maintained by promptfoo
Python · ≈23k stars · Apache-2.0
NVIDIA/SkillSpector
Security scanner that checks agent skills for injection, exfiltration and supply-chain risks before install.
Maintained by NVIDIA
Connections
Relations from the Harness Hub knowledge graph, as charted in the State of Harness reports.
Maintained by · 1
- cloudflareOrganisation
Similar entries · 2
- Gemini CLI Security ExtensionProject
- Trail of Bits SkillsProject
Sources
Verified Oct 29, 2026