Security Audit Skill

The skill drives a coding agent through six phases: mapping architecture, trust boundaries and input surfaces into a coverage ledger; assigning isolated hunters against units of that ledger; handing every unique candidate to a fresh verifier whose job is to disprove it; writing records into findings.json against a schema; having separate agents re-check the final source claims; and only then deriving the report files.

The three verdicts are kept apart on purpose. A confirmed finding carries a complete source trace and a bounded observed result, needs_validation names the exact unresolved fact and gets no severity, and rejected records a candidate that was disproved. Repeat runs on the same repository build on the earlier ledgers instead of starting over. Cloudflare describes this as the single-repo starting point its fleet-wide vulnerability harness grew out of, and running it needs Node.js plus an OS-enforced sandbox for anything the target controls.