Cloudflare open sourced a security auditor, and its best idea has nothing to do with security
Cloudflare has open sourced the security audit skill that seeded its internal vulnerability discovery harness. MIT licensed, past 5,500 stars in about three months. It is not a scanner. It is a skill, a folder of structured instructions a coding agent loads and follows. You point Claude Code, Codex or Cursor at a repo, ask for a security audit, and it runs a fleet of isolated sub-agents through six phases. The security part is good. The part worth stealing is one line in the design principles. A
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.