security-audit

A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.

This is the skill that seeded Cloudflare’s vulnerability discovery harness, described in Build your own vulnerability harness. The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.

What it does

The skill runs a structured audit in six phases:

1. Reconnaissance — map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json.
2. Coverage-led hunting — assign isolated hunters from ledger units, record their checks, and use coverage critics to find gaps.
3. Candidate validation — give every unique candidate to a fresh verifier that tries to disprove it.
4. Structured output — write confirmed, needs_validation, and rejected records to findings.json and validate them against report-schema.json.
5. Independent record verification — fresh agents verify final source claims. Material replacements receive another independent verifier.
6. Target-neutral reporting — derive REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from the verified records and coverage ledger.

The parent runs validate-coverage-ledger.cjs after creating the ledger and after each later ledger update. It runs validate-findings.cjs in Phase 4 and again after every Phase 5 replacement.

The verdicts are distinct: confirmed has a complete source trace and bounded observed result, needs_validation has an exact unresolved fact and no severity, and rejected records a disproved candidate.

Multiple runs against the same repo are additive. The skill uses prior ledgers and findings to target gaps, revalidate changed source, and carry forward current-source evidence without treating stale or unresolved work as covered.

Installation

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit

Requirements

• A coding agent with a model that supports tool use and parallel sub-agents
• Node.js for the zero-dependency findings and coverage-ledger validators
• An OS-enforced sandbox for target-controlled builds, tests, processes, browsers, emulators, fuzzers, and fixtures

Design principles

• Only confirm established boundary failures. Keep a source-grounded blocked lead as needs_validation with its exact unresolved fact.
• Adversarial validation. The agent that checks a finding is never the agent that found it.
• Severity requires impact. Likelihood x impact, not deviation from a checklist.
• Defense-in-depth gaps are not vulnerabilities. If Layer A prevents the attack, the absence of Layer B is a hardening note.
• Multiple runs improve coverage. In our test runs, a single run found roughly half of the vulnerabilities that repeated runs found in total.

License

MIT