Skip to main content

​
Penthera and Cloudflare’s security-audit skill

Pro. For “how does Penthera compare to Cloudflare’s security-audit skill, and how do I run both?”
Last checked: 2026-10-22 against the repository at commit c1c8a8c (2026-09-14).

​
Use them together

security-audit-skill is an MIT-licensed skill that turns a coding agent into a security auditor. It comes from Cloudflare’s internal vulnerability-discovery harness. The agent maps the architecture, sends isolated sub-agents to hunt across attack classes, has fresh agents try to disprove each candidate, and writes a schema-checked findings.json and reports. The reasoning is done by the language model; two small Node.js validators check the output files. The two answer different questions:
  • The skill asks a model to read your code like a security researcher. It can find business-logic flaws, authorization mistakes and bugs no rule describes, in any language, at the cost of model time and with results that vary between runs.
  • Penthera runs fixed, readable checks in seconds, offline, with the same answer every time. It finds known classes of problems, checks what your running app and your dependencies actually do, and verifies its own fixes.
A reasonable setup: Penthera on every commit and pull request, because it is fast, free and repeatable. The skill for a deep review before a release, or when Penthera reports nothing and you still want a second opinion.

​
Side by side

​
Where the skill goes further

  • Depth on your own code. A model reading code can find flaws that no rule describes: broken authorization, unsafe state machines, logic errors.
  • Breadth of languages and targets, from memory safety in native code to RPC and mobile.
  • A disciplined method: an explicit coverage ledger, independent disproof of each candidate, and strict sandbox rules before running any target code. Those ideas are worth copying.

​
Where Penthera adds something

  • Speed, repeatability and cost: seconds, the same result every time, no model bill. That is what a CI gate needs.
  • Outside the source: the running app, what packages do when installed, and the agent config on your machine.
  • Fixes that are verified by a re-scan on a local branch, and an evidence bundle for auditors.
  • Measured accuracy, with intervals and limits stated.

​
Run both

Then ask your agent for a full security audit. Treat findings that both tools report as the highest priority, and use Penthera to re-check fixes for anything the skill found that Penthera has a rule for. All comparisons · Back to the README