Cloudflare gave away the coding-agent skill behind its own vulnerability hunting, a free first pass on work that otherwise starts a paid engagement at several thousand dollars.
A company gearing up for a SOC 2 audit or an enterprise security questionnaire usually starts the same way. Someone hires an outside firm to run a penetration test on the web app, and the invoice for that alone runs $5,000 to $50,000, depending on how complex the app is. Across all types of engagements, the market for a pentest spans roughly $2,500 to $50,000. Cloudflare just gave away, for free, the coding-agent skill it built to run a structured first pass on exactly that kind of work.
The project is security-audit-skill, MIT licensed, and it has already picked up 13.2k stars and 707 forks on GitHub. It is not a scanner. It is a set of instructions and validators that turn a coding agent, like Claude Code or a similar tool, into something closer to a supervised audit team. The skill runs six phases: reconnaissance to map the codebase's architecture and trust boundaries, coverage-led hunting where isolated sub-agents check off units of a coverage ledger, candidate validation where a separate fresh agent tries to disprove each finding, structured output written to a machine-readable findings file, independent verification of the final claims, and a target-neutral report at the end. Cloudflare's README says this is the same skill that seeded the internal vulnerability-hunting harness the company has written about separately, scaled down to something a single team can run against a single repo.
Installing it is a one-line command through the Skills CLI: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit. Once installed, you just ask your coding agent to do a security audit, find vulnerabilities in a folder, or pen-test the code, and the skill takes over.
Who this fits. An internal engineering or IT lead at a company that ships its own web app or API is the natural user here. If you already have a coding agent in your workflow, this gives that agent a repeatable, documented process instead of an ad hoc "look for bugs" prompt. It is a reasonable thing to run before a release, between formal pentest cycles, or while triaging where a limited security budget should go next. It is a much harder sell as a replacement for the pentest itself, and Cloudflare does not pitch it that way.
The honest caveats. The skill's own design principles are worth reading closely, because they are also its limits. It only confirms a finding when there is a complete, source-grounded trace and a bounded, observed result. Anything short of that gets filed as needs_validation rather than a real finding, which is the right instinct but means the output is deliberately conservative. Cloudflare's own testing notes that a single run found roughly half of what repeated runs turned up in total, so one pass is not a finished audit. Running it well also requires real infrastructure: a coding agent whose model supports tool use and parallel sub-agents, Node.js for the included validators, and an OS-enforced sandbox that disables outbound networking, limits resources, and only allows writes to scratch paths. None of that is free labor, even if the skill itself has no license fee. And for the compliance-driven reason many companies buy a pentest in the first place, Astra's own cost breakdown notes that frameworks like HIPAA and PCI DSS carry their own testing and documentation requirements. A free, self-run audit does not produce the third-party attestation an auditor or a customer's security questionnaire is usually asking for.
What this points at is a narrower and more useful claim than "AI replaces pentesters." It lowers the cost of the first pass, the part where a team finds the obvious and the moderately hidden problems before anyone writes a check to a testing firm. The verified, paid engagement with a human tester and a signed report is a different product, built for a different kind of accountability. Worth asking, if your team adopted something like this tomorrow: would it change what you pay a testing firm to look at, or just change what you already knew you should have fixed first.