Overview

Elevate your code security with security-audit, a sophisticated coding-agent skill designed to transform your agent into a dedicated security auditor. This skill orchestrates a multi-phase security audit process, generating independently verified, machine-readable findings. It's the foundational technology that powered Cloudflare's evolution of its vulnerability discovery harness, offering a robust starting point for comprehensive security reviews.

Key Features

• Structured Multi-Phase Audit: Executes a meticulously defined six-phase audit: Reconnaissance, Coverage-led Hunting, Candidate Validation, Structured Output, Independent Record Verification, and Target-Neutral Reporting.
• Isolated Agent Orchestration: Leverages isolated agents for each phase, ensuring unbiased analysis and validation.
• Machine-Readable Findings: Produces findings.json with confirmed, needs_validation, and rejected verdicts, all validated against a report-schema.json.
• Independent Verification: Guarantees that findings are validated by agents separate from those that discovered them, ensuring adversarial integrity.
• Comprehensive Reporting: Generates clear, human-readable reports including REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md.
• Additive Runs: Supports cumulative audits, intelligently targeting gaps and revalidating changed source code across multiple runs.
• Extensive Attack Class Coverage: Includes specialized hunting classes for a wide range of targets, from memory safety and AI/LLMs to web protocols, cloud deployments, and supply chain security.

Typical Use Cases

• Automated Vulnerability Discovery: Integrate security-audit into your CI/CD pipeline to proactively identify security flaws before deployment.
• Comprehensive Security Reviews: Conduct in-depth, structured security audits of codebases with repeatable and verifiable results.
• Continuous Security Monitoring: Run additive audits regularly to track security posture and identify new vulnerabilities as code evolves.
• Security Research & Development: Utilize as a powerful tool for AI-driven security research and the development of novel vulnerability detection techniques.
• Enhancing Existing Security Harnesses: Deploy as a core component or a starting point for building more sophisticated, fleet-wide vulnerability discovery systems.