Cloudflare's AI security check argues with itself

What it is

Cloudflare has shared a free skill for AI coding agents. You point it at a project's code and it runs a security audit: it gets the lay of the land, hunts for weak spots and writes up what it finds.

Cloudflare says this small, single-project version is where their own in-house system for finding vulnerabilities began. That system later grew much bigger. So you're looking at the seed of something they actually rely on.

The part I love

Most automated checkers raise the alarm about everything. This one argues with itself. When the agent thinks it has found a problem, a fresh agent arrives with a single job: try to prove it wrong. Only the findings that survive get written down, in a tidy file checked against a fixed template, and then each one is verified again on its own.

It's like one chef tasting the sauce, then a second chef who didn't make it tasting it again before it leaves the kitchen.

Why it matters for your business

If someone builds software for you, whether that's an agency, a freelancer or your own small team, this gives them a careful second opinion on the code at no cost. Fewer false alarms means less wasted time. A structured report means you can actually follow what was found and what got fixed.

Words worth knowing

• Skill: a packaged set of instructions an AI agent can pick up, like a recipe card it follows step by step.
• Security audit: a methodical check of software for holes someone could abuse.
• MIT license: a very open license. Anyone can use the tool, including for commercial work.
• False positive: an alarm about a problem that isn't really there.

Something to try

Send this link to whoever builds your software and ask if they'd run it on your project: github.com/cloudflare/security-audit-skill