Cloudflare open-sources security-audit-skill, a six-phase coding-agent vulnerability harness
evilsocket · x · 2026-09-22
Cloudflare open-sourced security-audit-skill (19.4k stars on GitHub), a coding-agent skill that turns your agent into a security auditor — the single-repo starting point that grew into Cloudflare's fleet-wide vulnerability discovery harness. It orchestrates isolated agents through six phases:
- Reconnaissance: maps architecture, trust boundaries, and input surfaces into architecture.md and coverage-ledger.
- Coverage-led hunting: assigns isolated hunters from ledger units, with coverage critics to find gaps
- Candidate validation: every unique candidate goes to a fresh verifier that tries to disprove it
- Structured output: confirmed / needsvalidation / rejected findings
- Independent record verification and target-neutral reporting
A directly reusable reference for security teams and agent engineers alike.
Related event: Cloudflare Open-Sources Security Audit Skill for Coding Agents(2 posts)→
More from coding & agent
- Boubou: open-source CLI turns your laptop into a fully local voice AI hub — alexcovo_eth · 2026-11-12
- User automates entire video clipping workflow with Nous Research's Hermes agent — Teknium · 2026-11-12
- As models improve, writing good evals gets harder and more important — amankhan · 2026-11-12
- Prime agent ships with day-one multi-agent communication, runs in Minecraft unmodified — sarahcat21 · 2026-11-12
- Autonomous agent edits just 1,024 weights to lift Qwen3.5 0.8B from 7.4% to 37.4% on MATH-500 — VictorSanh · 2026-11-12
- Omarchy 4.6 lets you share local AI models across your tailnet, says DHH — alexcovo_eth · 2026-11-12