Cloudflare's Security Audit Skill Has an Open Issue Saying a Made-Up Finding Can Pass Validation

Cloudflare's security-audit-skill, an MIT-licensed skill that turns a coding agent into a six-phase vulnerability auditor, shows 43 open issues and 73 open pull requests on GitHub. One of the issues says a made-up finding can pass its validator.

The README calls the project the single-repo starting point for Cloudflare's vulnerability discovery harness. It lists Cloudflare as owner and names no individual authors. It needs a coding agent with a model that supports tool use and parallel sub-agents, plus Node.js for the validators. Install is one command: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit.

The six phases in the README

Phase	What it does
1. Reconnaissance	Maps architecture, trust boundaries and input surfaces
2. Coverage-led hunting	Assigns isolated hunters from ledger units
3. Candidate validation	A fresh verifier tries to disprove each candidate
4. Structured output	Writes findings.json records checked against a schema
5. Record verification	Fresh agents check the final source claims
6. Reporting	Writes REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md

The README's design principles include "Only confirm established boundary failures" and "Defense-in-depth gaps are not vulnerabilities." It says a single run found about half of the vulnerabilities that repeated runs found in total, so runs are additive. It gives no counts behind that claim.

Sandbox rule and what happens without one

Builds, tests and other target-controlled processes need an OS-enforced sandbox. Without one the skill does not execute target code and leaves leads marked needs_validation. Unspecified output goes to a directory under the user's home folder.

A DEV Community post by a user called WonderLab, dated Sep. 19, gave the repository's creation date as 2026-06-18 and a star count of 13,825 or more, without saying when the count was taken. The post links Cloudflare's own blog on the larger harness but does not quote it, and the author's praise is opinion. The author also promotes their own marketplace, so it is not a neutral source. This report did not read Cloudflare's blog post.

Issues 128, 134 and 94 on the tracker

The issue tracker is the part of the project the README does not summarise. Titles below are quoted from the issues page.

• #128: "No fail-closed isolation check: an agent following the scratch-local HOME requirement wiped the real user profile." It describes data loss.
• #134: "Findings cite a file and a line but no bytes, so a made-up finding passes validation."
• #94: "Target-controlled repo name drives output path and prior-run reuse (path escape, cross-target prior-run poisoning)."
• #117: "Validators are non-functional on Windows," because readFileWithinLimit() rejects every input there.
• #114: reports 65 open pull requests with none merged in 42 days. The repository page now shows 73.

The issues page does not label any issue as a false-positive report. #134 is the closest, going by its title alone, and the maintainers' response is not visible on the pages read.

Agent tooling that runs against code it did not write has raised similar questions elsewhere. The Stroq audit tool describes itself as a filter and not a sandbox, and NVIDIA's NVKE preview shipped with API authentication off.

Cloudflare has not said whether the open pull requests will be merged or when #128 will be fixed.