Description
Ask an AI to skim your code and you get dozens of alleged bugs, half of them false positives and the rest yours to reproduce. This skill, open-sourced by Cloudflare, splits the job instead: isolated agents do reconnaissance and hunting, then fresh agents whose only task is to disprove every candidate. Only findings that survive count.
It is the seed of Cloudflare's own vulnerability discovery harness; their blog explains how a single-repo skill grew into a fleet-wide pipeline. In your own project, tell your agent "security audit this codebase" and the whole workflow kicks in, ending with a report backed by source traces and independent verification.
Six-phase audit: reconnaissance (architecture, trust boundaries, input surfaces), coverage-led hunting, independent candidate validation, structured output, record-level re-verification, and reporting.
Three distinct verdicts: confirmed means a complete source trace and an observed result; needs_validation names the one unresolved fact and carries no severity; rejected records the disproved guess. They never blur together.
Coverage ledger: coverage-ledger.json tracks which units were checked and which were not, so repeat runs fill gaps and revalidate changed code instead of treating stale work as covered.
Playbooks by target type: memory safety, AI and LLM, web protocol and auth, client-side, supply chain and release, cloud and deployment, data isolation, desktop and mobile, and more.
Zero-dependency validators: Node.js scripts check findings and the ledger against a JSON Schema, easy to plug into your own pipeline.
Install and requirements: one Skills CLI command installs it. It needs a coding agent with tool use and parallel sub-agents; running target builds or tests requires a sandbox with no network and resource limits, otherwise the lead stays as needs_validation and no target code runs.
It is the seed of Cloudflare's own vulnerability discovery harness; their blog explains how a single-repo skill grew into a fleet-wide pipeline. In your own project, tell your agent "security audit this codebase" and the whole workflow kicks in, ending with a report backed by source traces and independent verification.
Features
Six-phase audit: reconnaissance (architecture, trust boundaries, input surfaces), coverage-led hunting, independent candidate validation, structured output, record-level re-verification, and reporting.
Three distinct verdicts: confirmed means a complete source trace and an observed result; needs_validation names the one unresolved fact and carries no severity; rejected records the disproved guess. They never blur together.
Coverage ledger: coverage-ledger.json tracks which units were checked and which were not, so repeat runs fill gaps and revalidate changed code instead of treating stale work as covered.
Playbooks by target type: memory safety, AI and LLM, web protocol and auth, client-side, supply chain and release, cloud and deployment, data isolation, desktop and mobile, and more.
Zero-dependency validators: Node.js scripts check findings and the ledger against a JSON Schema, easy to plug into your own pipeline.
Install and requirements: one Skills CLI command installs it. It needs a coding agent with tool use and parallel sub-agents; running target builds or tests requires a sandbox with no network and resource limits, otherwise the lead stays as needs_validation and no target code runs.
