An agent asked to find missing authorization checks can identify an unguarded handler and report it as a vulnerability—while being wrong, because it cannot see the upstream middleware making the absent check intentional. The Security Audit Skill is a six-phase workflow for Claude Code, published by Cloudflare as the origin of their internal vulnerability harness, producing three verdict types: confirmed findings, unresolved leads, and disproved candidates.
How the workflow builds evidence
Before any hunting, the agent maps the application: architecture, trust boundaries, entry points, and input surfaces. This produces a coverage ledger tracking what has been examined—without it, a clean output cannot distinguish a checked area from an unvisited one.
Isolated sub-agents then run against specific attack-class and coverage-unit combinations, with a coverage critic identifying gaps.
Every candidate finding goes to a fresh agent whose sole job is to disprove it. The README states this directly: “The agent that checks a finding is never the agent that found it.” An agent asked to validate what it found tends to confirm its own output. Adversarial validation breaks that loop.
Findings are written to findings.json, validated against a schema by a zero-dependency Node.js script, and re-verified by fresh agents checking source citations. Final reports separate output into the three verdict categories.
The three verdicts
confirmed: a complete source trace and a bounded observed result establishing that a trust boundary is actually crossed.needs_validation: an exact unresolved fact, no severity. Cannot be confirmed until that specific unknown—typically execution-dependent behavior—is resolved.rejected: a validator found that the candidate does not establish a boundary failure.
A finding cannot advance to confirmed without resolving the named unresolved fact. Severity requires demonstrated impact, not deviation from a checklist.
The missing authorization check, examined
A hunter flags a suspected missing authorization check. The handler contains no explicit identity verification. Three possible outcomes:
confirmed: No upstream authentication middleware. Endpoint is reachable by unauthenticated external requests. Operation is sensitive. Source trace complete, severity assigned.
needs_validation: The handler looks unprotected, but the sandbox cannot exercise the upstream API gateway to confirm whether session state is enforced. Exact unresolved fact recorded, no severity, awaiting manual reproduction.
rejected: Authentication is enforced at the router level before the handler executes. The absent check is an architectural choice. The README documents this principle: “Defense-in-depth gaps are not vulnerabilities. If Layer A prevents the attack, the absence of Layer B is a hardening note.”
The third outcome is the most instructive. An agent that cannot trace the full control path will misclassify this as a vulnerability every time.
Requirements
The workflow requires a coding agent with tool use and parallel sub-agents, Node.js for the validators, and an OS-enforced sandbox—external networking disabled, resource limits enforced, writes restricted to scratch paths. Without the sandbox, execution-dependent leads stay as needs_validation rather than being confirmed.
Limitations
The skill makes no coverage guarantee. Cloudflare’s own testing found a single run catches roughly half of what repeated runs find. A clean output does not mean an application is secure. The skill reviews code the agent can read; it does not model production topology or runtime behavior beyond the sandbox. This is not a penetration test, a secure development program, or compliance assurance.
Governance
Code and credentials entering the agent’s context must be handled accordingly. The execution environment must be controlled. Prioritization and remediation remain human responsibilities. Cloudflare’s blog describes their automated fixer as something that “never merges code on its own; a human must review the branch”—in a mature fleet-wide harness. In this single-repository skill there is no automated fixer. Findings reach a human reviewer; the next decision is theirs.
Why this is an engineering workflow
Running this skill requires read access to a codebase, understanding of the application’s trust model, a controlled execution environment, and engineering capacity to act on findings. Those conditions rule out directing it at an external system you do not own. This is evidence-based security analysis for authorized code owners.
Sources: github.com/cloudflare/security-audit-skill (README) · blog.cloudflare.com/build-your-own-vulnerability-harness. Retrieved 8 October 2026.
#DevSecOps #AgentSkills #ApplicationSecurity