resource-playbookresource-playbook

github.comPublished

A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings - cloudflare/security-audit-skill

Summary: This GitHub repository provides a coding-agent skill for conducting structured security audits. It operates through six phases: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. The system utilizes isolated agents and coverage critic feedback to find security vulnerabilities, ensuring findings are independently verified by agents separate from the discoverers. The skill employs a verdict system using labels such as 'confirmed', 'needs_validation', and 'rejected' based on source trace and observed impact. It supports repeated runs to iteratively improve coverage, with prior analyses used to target gaps and revalidate changed sources. Installation and execution are managed via the Skills CLI, requiring Node.js for validation and an OS-enforced sandbox for target code execution. The skill is noted as the initial prototype that seeded Cloudflare's broader vulnerability discovery harness.

Description: A coding-agent skill that orchestrates multi-phase security audits by generating independently verified, machine-readable findings.

AI-generated