What is the Cloudflare security review skill?

cloudflare/security-audit-skill is an MIT-licensed coding-agent skill that runs a six-phase security audit: reconnaissance, coverage-led hunting by isolated sub-agents, adversarial validation by agents that did not find the bug, schema-validated findings.json, independent record verification and reporting. You install it into Claude Code, Codex or another agent with sub-agents via npx skills add. It had about 67,200 GitHub stars on November 9, 2026. It is prompts plus two validators, not a scanner binary, and runs on your own model tokens.

What is the best open-source AI tool for security review of code?

As of November 9, 2026: Cloudflare's security-audit skill for deep, verified whole-codebase audits inside an agent you already use; Strix (Apache-2.0, about 74,500 stars) when you want findings proven with working exploits in a Docker sandbox; Anthropic's claude-code-security-review GitHub Action for cheap per-pull-request checks; and Alibaba's Open Code Review CLI (Apache-2.0, v1.13.6) for low-noise, line-precise review in CI at a fraction of an agent's tokens.

Are AI security review tools safe to run on untrusted pull requests?

Not by default. Anthropic states its claude-code-security-review Action is not hardened against prompt injection and should only review trusted PRs, recommending that workflows from external contributors require maintainer approval. Cloudflare's skill refuses to execute target code unless an OS-enforced sandbox with no network is available. Strix runs its testing inside a Docker sandbox. Treat code under review as hostile input to the model.

Do these tools replace Semgrep, CodeQL or Snyk?

No. They find logic and authorisation bugs that rules miss, but they cost model tokens, are non-deterministic (Cloudflare says one run of its skill finds roughly half of what repeated runs find) and Cloudflare's skill does not cover dependency CVEs. Keep a rule-based scanner and a dependency scanner in CI and use AI review for depth.

Quick Answer

Best Open-Source AI Security Review Tools for Code (2026)

Published: November 9, 2026

The short answer

The open-source AI security reviewers worth running in November 2026 split by depth and cost. As of November 9, 2026:

Cloudflare security-audit skill — best for a deep, adversarially verified audit of a whole codebase, run inside Claude Code, Codex or another agent with sub-agents. MIT.
Strix — best when you need a finding proven: autonomous pentest agents that run your app in Docker and produce working proofs of concept. Apache-2.0, with a paid Strix Cloud.
Anthropic claude-code-security-review — best cheap, diff-only check on every trusted pull request. MIT GitHub Action.
Alibaba Open Code Review — best low-noise reviewer in CI: line-level comments at about one-ninth the tokens of a general agent, with lower recall by design. Apache-2.0.

The comparison

Stars, licences and versions from GitHub on November 9, 2026.

	Cloudflare security-audit skill	Strix	claude-code-security-review	Open Code Review
What it is	Prompt pack + 2 validators for an agent	Autonomous pentest agents (CLI)	GitHub Action on Claude Code	Hybrid deterministic + LLM review CLI
Scope	Whole codebase	Running app / repo	PR diff	Diff, or whole files with `ocr scan`
Proves findings	Adversarial re-verification; executes code only in a no-network sandbox	Working PoC exploits	False-positive filtering	Precision-first rules + reflection
Models	Your agent’s model	Any provider (OpenAI, Anthropic, Google, OpenRouter…)	Claude (default `claude-opus-4-1-20250805`; set `claude-model`)	OpenAI, Anthropic, custom endpoints, or host agent’s model
Stars / licence	~67,200 / MIT	~74,500 / Apache-2.0	~6,800 / MIT	~49,700 / Apache-2.0
Last activity	Last push Sep 14, 2026	Daily (Nov 9, 2026)	Last push Feb 11, 2026	v1.13.6, Nov 5, 2026
Cost driver	Many sub-agents; token-heavy	LLM tokens + Docker host	One Claude Code run per PR	~1/9 the tokens of a general agent (Alibaba benchmark)

Cloudflare security-audit skill — the deep audit

Install with npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit, then ask your agent to security-audit the codebase. It maps the architecture, builds a coverage ledger of subsystem × trust boundary × attack class, sends isolated hunters after each unit, then hands every candidate to a fresh agent whose job is to disprove it. Findings land as confirmed, needs_validation or rejected in a schema-checked findings.json. Two caveats from Cloudflare’s own README: one run finds roughly half of what repeated runs find, and without an OS-enforced, no-network sandbox it will not execute target code, so leads stay unconfirmed. Our full review covers token costs.

Pick it if you want a periodic deep audit and already pay for a capable coding agent.

Strix — findings with proof

Strix needs Docker and an LLM key; strix --target ./app-directory pulls its sandbox image and runs reconnaissance, exploitation and validation with a team of agents, then produces remediation guidance and patches. Its pitch is the opposite of static analysis: no finding without a working proof of concept. It also runs in CI on pull requests. See our Strix review.

Pick it if false positives are what kills your security programme.

claude-code-security-review — the cheap PR gate

A few lines of workflow YAML add a Claude Code security pass to every pull request: it analyses only changed files, comments findings on the PR and filters likely false positives, with optional custom filtering instructions. Two things to change on day one: the default model is still claude-opus-4-1-20250805, so set claude-model to a current Claude model (see our current API prices), and follow Anthropic’s warning that the Action is not hardened against prompt injection — require approval for workflows from external contributors.

Pick it if you want broad coverage on every change for little money.

Open Code Review — low noise in CI

Alibaba ran it internally for two years before open-sourcing it. Install with npm install -g @alibaba-group/open-code-review; it reads git diffs, lets an agent pull context from the repository, and positions comments on exact lines. Alibaba’s benchmark shows higher precision and F1 than Claude Code with the same model at about one-ninth of the tokens, with lower recall as a deliberate trade-off. It is a general code reviewer with security among its checks, not a dedicated audit tool. More in our Open Code Review review.

Pick it if developers ignore noisy bots and you need reviews that get read.

How to combine them

Every PR: Open Code Review or claude-code-security-review (trusted PRs only), plus your rule-based scanner.
Every release or quarter: Cloudflare’s skill on the whole repository, run twice on critical services because coverage grows with repeated runs.
Before launch or after major auth changes: Strix against a staging deployment.
Always: a dependency scanner — none of these replace one. For commercial options (Snyk, Semgrep, GitHub Advanced Security, Claude Security) see best AI security scanners.

Last verified: November 9, 2026.