Cloudflare open-sourced security-audit-skill under MIT license. The skill runs coding agents through a six-phase security audit: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.
The key design decision is that findings get verified by agents that did not discover them. A fresh agent re-checks claims before marking confirmed; otherwise findings land in needs_validation or rejected with disproof records. Structured JSON output against a schema makes coverage auditable rather than anecdotal.
Cloudflare shipping its internal audit methodology as a skill file is evidence that the skill format is becoming a distribution channel for security practice — procedures, not just code.