A structured security review of your own repo, from the terminal

A developer on the free-pi project, a free terminal coding agent, has bundled Cloudflare's open-source MIT-licensed security-audit skill, which maps a codebase, hunts for issues by coverage, attempts to disprove each candidate finding, and records results as structured confirmed, needs_validation and rejected entries checked against a JSON schema. Because free-pi lacks the parallel sub-agents and OS-enforced sandbox the skill's README assumes, a single agent both raises and judges each candidate, so the developer advises users to validate every finding themselves and to re-run audits after fixes since one run reportedly found roughly half of what repeated runs found.

Most "AI security review" prompts give you a pile of plausible-sounding warnings. Cloudflare's open-source security-audit skill https://github.com/cloudflare/security-audit-skill MIT describes a more disciplined method: map the code, hunt by coverage, try to disprove every candidate, and write findings as structured records. I work on free-pi, a free terminal coding agent that bundles the skill's audit method and reference checklists. This post explains the method and how to check its output. It is a guide, not a recorded run, and the commands are illustrative. Only review code you own or have permission to test. architecture.md and coverage-ledger.json . findings.json with confirmed , needs validation and rejected records, checked against a JSON schema. REPORT.md , FINDINGS-DETAIL.md and NEEDS-VALIDATION.md . The skill also has reference files of attack classes for web and auth protocols, client-side code, supply chain, cloud deployment, memory safety and more. The skill's README expects an agent that can run parallel sub-agents, so the agent that finds a problem is never the agent that checks it, plus an OS-enforced sandbox for running target code. free-pi has neither. It runs the skill in a single agent that follows the method itself. So the independent checking in the skill's design does not happen. The same agent raises and judges each candidate, and you should validate every finding yourself. Do not ask it to build or run code from a repo you do not trust. From your repo root: security audit this codebase A direct request asks for the full method; narrower questions get lighter guidance. The skill's default output directory is ~/security-audit-skill/<repo-name /run-<N , outside your repo. The skill's authors say a single run found roughly half of what repeated runs found, so run it again after your first round of fixes. It reads code. It cannot see your cloud settings, registry permissions or branch protection. Treat every finding as a lead to verify, not a verdict. To try it: npx free-pi-cli , sign in with GitHub, and ask for a security audit. More at freepi.ai https://freepi.ai/blog/audit-your-repo-with-security-audit-skill .