Cloudflare's open-source security-audit skill: six phases, finder and verifier separated
JeremyCMorgan · x · 2026-09-26
Cloudflare's security-audit-skill (MIT, 21k+ stars on GitHub) got fresh commits this week. It's a coding-agent skill that turns your agent into a security auditor, with a core design of isolating the finding agent from the verifying agent:
- Six phases: reconnaissance (architecture, trust boundaries, input surfaces → architecture.md + coverage-ledger.), coverage-led hunting (isolated hunters assigned from ledger units, coverage critics find gaps), candidate validation (each candidate given to a fresh verifier that tries to disprove it), structured output, independent record verification, and target-neutral reporting.
- Verdicts are confirmed / needsvalidation / rejected, all schema-validated and machine-readable.
- This skill seeded Cloudflare's vulnerability discovery harness, which has since grown into a fleet-wide multi-stage system; the single-repo skill is its starting point.
More from coding & agent
- CAPTCHAs Are Broken for the Agent Era: Time for Agent Digital Identities — RachelVT42 · 2026-09-26
- Vite Core Dev: AI Lets Me Do a Month of Work in a Week, Better Than Ever — cnakazawa · 2026-09-26
- Running Qwen3.8 Locally on 6x3090s with exllamav3 Hits 80-120 tok/s — takoulseum · 2026-09-26
- Unofficial hack silences Paseo scheduled task notifications by self-labeling agents — intellectronica · 2026-09-26
- Solo dev builds Mazkir, a remote MCP server giving all your AI agents one shared memory — BeneficialAntelope25 · 2026-09-26
- Claude Agent + Remotion: A Dev Workflow for Programmatic Video Editing and Motion Typography — realmeetjames · 2026-09-26