I wrote four security findings against a 47-line Node service. Two of them were false. One cites a file that does not exist.

Cloudflare's findings validator passed all four.

That is not a bug in the validator. It is the clearest way I found to show where the value of an AI security review actually sits.

The skill

cloudflare/security-audit-skill is a coding-agent skill that turns one agent into a coordinator of many: recon agents map the code, hunter agents look for bugs, and fresh verifier agents try to knock each finding down before it reaches a report. It was on GitHub trending this week with almost 2,000 stars in a day, 35,690 in total when I checked. MIT licensed. Cloudflare says it is the starting point of the vulnerability harness they now run across their whole fleet.

I measured it before reading it closely. The skill is 15 markdown files: 1,778 lines, 24,768 words, about 183 KB. At the usual four bytes per token that is roughly 46,000 tokens of instructions, loaded in pieces as a run needs them.…