How to Use Cloudflare's security-audit-skill Without Burning $10 in Claude Tokens

If you have ever pasted a repository into an AI coding assistant and asked it to "check for security bugs," you already know what happens next. The model skims three files, hallucinates a theoretical race condition that cannot actually be triggered, and completely misses the unauthenticated POST /api/checkout route sitting two folders away.

To solve this exact failure mode, Cloudflare open-sourced cloudflare/security-audit-skill (MIT licensed), the single-repository agent workflow that seeded their internal vulnerability discovery harness. Instead of relying on a single one-shot prompt, the skill forces coding agents like Claude Code, Cursor, and Codex to work through a 6-phase adversarial pipeline backed by local JSON ledgers: coverage-ledger.json and findings.json.

How Cloudflare's 6-Phase Adversarial Workflow Works

The core insight behind cloudflare/security-audit-skill is simple: LLMs lose track of state during long security reviews, and the same agent that proposes a bug is terrible at judging whether that bug is actually exploitable. Cloudflare fixes both problems by externalizing state to disk and separating the "Hunter" from the "Devil's Advocate Verifier":

• Phase 1: Reconnaissance and Trust Boundary Mapping - Before hunting for vulnerabilities, the agent maps entry points, privilege levels, and untrusted input surfaces into architecture.md and initializes coverage-ledger.json.
• Phase 2: Coverage-Led Hunting - Sub-agents systematically inspect each structural unit in coverage-ledger.json so high-risk API routes and middleware files are never skipped.
• Phase 3: Adversarial Candidate Validation ("Devil's Advocate") - Whenever a suspicious pattern is flagged, a separate verification pass is given one assignment: try to disprove the vulnerability by tracing the exact source-to-sink data flow and checking for upstream auth guards.
• Phase 4: Structured Ledger Output - Surviving bugs are written to findings.json as confirmed (with full source traces), while disproved theories are logged as rejected.
• Phase 5 & 6: Independent Record Verification and Reporting - Fresh checks verify every line number claim before generating the final remediation report.

The Hidden Catch for Indie Developers: Token Burn and Rate Limits

You can install the skill in compatible agent toolchains with a single command:

npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

However, when indie developers and solo founders run all 6 multi-agent phases cold against a Next.js, Vite, Lovable, or Bolt repository inside Claude Code, they immediately hit a wall:

1. 20+ Minute Cold Reconnaissance: Your coding agent spends 60% of its time and context window simply crawling folders to build coverage-ledger.json and hunting for basic secrets, missing security headers, or unpinned dependencies.
2. $8 to $15+ in API Token Burn (or Instant Rate Limits): Spawning isolated sub-agents to read every file from scratch burns through Anthropic API credits or triggers the Claude Pro 5-hour usage cap before you even reach remediation.

The 10-Second Shortcut: Pre-Seed Your coverage-ledger.json and findings.json

Deterministic static analysis (AST parsing, secret regex scanning, client JS bundle inspection, and targeted Tier-1 route analysis) does not need a 20-minute LLM loop. It takes less than 10 seconds when run on a purpose-built engine.

That is why we integrated Cloudflare's 6-phase ledger format directly into Vibe Code Detector:

• Instant Phase 1 & 2 Mapping: Paste your GitHub repository URL or live web app URL on the homepage. In 10 seconds, our deterministic AST and bundle scanner maps your untrusted HTTP entry points, auth middleware, supply chain manifests, and client bundles.
• Adversarial Devil's Advocate Filtering: Our Tier-1 route analyzer applies source-to-sink disproof checks before flagging authorization or webhook signature flaws.
• 1-Click coverage-ledger.json & findings.json Export: Unlock your single report for $1.99 (or grab the $5 All-Projects Founder Pass) and click Cloudflare Audit Ledger (.json) in your report view. You get a pre-populated coverage-ledger.json, a confirmed findings.json, and copy-paste fix prompts ready for Cursor and Claude Code.

Instead of paying $10 in LLM API tokens every time you audit a repo from scratch, let our scanner build the ledger and pin the exact file lines in 10 seconds, then hand the verified prompt deck to Cursor or Claude Code to apply the patches in one pass.