security-audit is an open-source coding agent skill from Cloudflare’s security team (MIT, about 34K stars) and the starting point of its internal vulnerability-hunting system. Install it in Claude Code or Codex, say “security audit this codebase”, and it runs reconnaissance, hunting, adversarial validation, structured output, independent review and reporting. We tested the install and bundled tests and explain the two modes, three tiers, sandboxing and cost.