Most "AI security review" prompts give you a pile of plausible-sounding warnings. Cloudflare's open-source security-audit skill (MIT) describes a more disciplined method: map the code, hunt by coverage, try to disprove every candidate, and write findings as structured records.
I work on free-pi, a free terminal coding agent that bundles the skill's audit method and reference checklists. This post explains the method and how to check its output. It is a guide, not a recorded run, and the commands are illustrative. Only review code you own or have permission to test.
architecture.md and coverage-ledger.json. findings.json with confirmed, needs_validation and rejected records, checked against a JSON schema.REPORT.md, FINDINGS-DETAIL.md and NEEDS-VALIDATION.md.
The skill also has reference files of attack classes for web and auth protocols, client-side code, supply chain, cloud deployment, memory safety and more.
The skill's README expects an agent that can run parallel sub-agents, so the agent that finds a problem is never the agent that checks it, plus an OS-enforced sandbox for running target code. free-pi has neither. It runs the skill in a single agent that follows the method itself.
So the independent checking in the skill's design does not happen. The same agent raises and judges each candidate, and you should validate every finding yourself. Do not ask it to build or run code from a repo you do not trust.
From your repo root:
security audit this codebase
A direct request asks for the full method; narrower questions get lighter guidance. The skill's default output directory is ~/security-audit-skill/<repo-name>/run-<N>, outside your repo.
The skill's authors say a single run found roughly half of what repeated runs found, so run it again after your first round of fixes.
It reads code. It cannot see your cloud settings, registry permissions or branch protection. Treat every finding as a lead to verify, not a verdict.
To try it: npx free-pi-cli, sign in with GitHub, and ask for a security audit. More at freepi.ai.