Cloudflare open-sources six-phase security audit skill for coding agents, 24.7k stars
tom_doerr · x · 2026-10-06
- Cloudflare open-sourced security-audit-skill on GitHub, turning a coding agent into a security auditor; it quickly reached 24.7k stars.
- The skill runs six phases: reconnaissance (mapping architecture, trust boundaries, input surfaces into architecture.md and coverage-ledger.), coverage-led hunting with isolated hunter agents, candidate validation by fresh verifiers that try to disprove each finding, structured output (confirmed / needsvalidation / rejected), independent record verification, and target-neutral reporting.
- It is the single-repo starting point of Cloudflare's internal vulnerability discovery harness, now a multi-stage fleet-wide system, detailed in the blog post "Build your own vulnerability harness."
More from coding & agent
- 1Password Is the Biggest Pain Point for AI Computer Use, Developer Says — aronchick · 2026-10-06
- Dev returns to Codex after a week on Opus 5.5: "basically unusable" — jacob_posel · 2026-10-06
- Zip Rebuilt Its Agent on LangGraph and LangSmith, Cutting Weeks-Long Feature Work — LangChain · 2026-10-06
- Dev shows custom voxel agent converting real buildings with high detail — Promptmethus · 2026-10-06
- Cursor SDK adds run.steer() to redirect agents mid-run, backgrounding subagents — tetsuoai · 2026-10-06
- 4DCodeBench: new benchmark tests coding agents on reconstructing dynamic 3D scenes from video — CSProfKGD · 2026-10-06