security-audit-skill (cloudflare/security-audit-skill) — vendor claims and pricing, checked_on 2026-10-28 (UTC+8)
Source: README at commit c1c8a8c1471069fb0e188eeaff69b8e8db6564a8 (2026-09-14), https://github.com/cloudflare/security-audit-skill
GitHub API 2026-10-28: {'stargazers_count': 50215, 'forks_count': 3154, 'created_at': '2026-06-18T14:08:44Z', 'pushed_at': '2026-09-14T19:29:02Z', 'open_issues_count': 99} MIT
Pricing: Free, MIT. No account. Needs your own coding agent + a model that "supports tool use and parallel sub-agents" (model costs are yours).

Claims (verbatim):
C1 Install: "npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit"
C2 Files table: "validate-findings.cjs | Zero-dependency validator for findings.json in Phases 4 and 5" ; "validate-coverage-ledger.cjs |
   Zero-dependency validator for coverage-ledger.json in Phases 1–5"; plus their test files.
C3 "A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance,
   coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting."
   Usage: "Start your coding agent in (or pointed at) the codebase you want to audit, then ask it to do a security audit".
   "Adversarial validation. The agent that checks a finding is never the agent that found it."
   Requirements: "An OS-enforced sandbox ... Without these controls, the workflow keeps the lead as needs_validation instead of executing target code."
   "In our test runs, a single run found roughly half of the vulnerabilities that repeated runs found in total."