Cloudflare security-audit-skill
An agent skill that splits a security audit into six phases, and makes a different agent try to disprove every bug before it is reported.
Verdict pending
Video and verdict: December 1, 2026
What we're testing
- Static review of the skill itself before installing it
- Run it against the source code of OWASP Juice Shop, an app with known bugs, in Docker on a throwaway server
- Score it against Juice Shop's own list of marked vulnerable lines, with that list hidden from the agent
- Quick profile vs standard profile: what does paying more buy you?
- What one full audit costs in API usage
The test runs are done. The score, the misses and the cost come out with the video on December 1.