[{"data":1,"prerenderedAt":213},["ShallowReactive",2],{"en-post-104":3},{"id":4,"title":5,"body":6,"description":12,"extension":206,"meta":207,"navigation":208,"path":209,"seo":210,"stem":211,"__hash__":212},"content/post/104.md","104",{"type":7,"value":8,"toc":194},"minimark",[9,13,18,45,49,64,68,102,106,109,113,126,130,144,148,160,164,171,177,183],[10,11,12],"p",{},"cloudflare/security-audit-skill is an open source Agent Skills package from Cloudflare that turns a coding agent into a security auditor. It breaks a full security audit into six stages, run by isolated sub agents, and produces machine readable findings that a human can also review independently. The repository is the open source starting point of Cloudflare internal vulnerability discovery harness, and it fits teams and individuals who want a systematic, repeatable health check of their own code. Rather than pointing a SAST scanner at a repo and drowning in thousands of alerts, it reads more like an auditable methodology with reusable scaffolding, and the structure makes it clear what was covered and what was not.",[14,15,17],"h2",{"id":16},"what-it-does","What it does",[10,19,20,24,25,28,29,32,33,36,37,40,41,44],{},[21,22,23],"code",{},"security-audit-skill"," is organized in the Agent Skills format and splits an audit into six stages. Reconnaissance maps the architecture, trust boundaries, input surfaces, and deterministic coverage, and writes the results to ",[21,26,27],{},"architecture.md"," and ",[21,30,31],{},"coverage-ledger.json",". Coverage led hunting dispatches isolated hunters from the ledger and records each check. Candidate validation hands every candidate to a fresh verifier that tries to disprove it. Structured output writes conclusions to ",[21,34,35],{},"findings.json"," and validates them against ",[21,38,39],{},"report-schema.json",". Independent record verification uses a fresh agent to re check the final source claims. Target neutral reporting derives ",[21,42,43],{},"REPORT.md"," and similar deliverables from the verified records. The whole flow orbits a coverage ledger so the audit stays complete and non overlapping, and every claim can be traced back to where it came from.",[14,46,48],{"id":47},"what-problem-it-solves","What problem it solves",[10,50,51,52,55,56,59,60,63],{},"Traditional security audits lean heavily on humans, which makes them hard to scale, easy to miss things, and difficult to reproduce. This skill uses isolated sub agents plus a coverage ledger plus independent verification to turn auditing into a checkable process. Its conclusions are sorted into three classes: ",[21,53,54],{},"confirmed"," means a complete source chain and constrained observations, ",[21,57,58],{},"needs_validation"," means a concrete open fact with no severity yet, and ",[21,61,62],{},"rejected"," means a candidate that was disproved. Running it repeatedly on the same repo is incremental, it reuses the old ledger and findings to fill gaps and re verify changed source, and it never reports stale or unfinished work as covered. That is especially useful for smaller teams without a dedicated security hire who still want periodic checkups, and for larger teams that want an audit trail they can hand to reviewers.",[14,65,67],{"id":66},"language-and-architecture","Language and architecture",[10,69,70,71,74,75,28,78,81,82,84,85,84,87,89,90,92,93,84,95,89,98,101],{},"The main language is JavaScript. The workflow is defined in Markdown through ",[21,72,73],{},"SKILL.md",", and the companion validators ",[21,76,77],{},"validate-coverage-ledger.cjs",[21,79,80],{},"validate-findings.cjs"," are Node scripts that the parent agent runs after building the ledger and after every update. The attack surface docs are highly modular, covering general attack classes, memory safety and binary or kernel, AI and LLM prompt injection, web protocols and auth, client side or browser, supply chain and release, cloud and deployment, RPC and messaging protocols, and resource exhaustion and availability. Core artifacts include ",[21,83,27],{},", ",[21,86,31],{},[21,88,35],{},", and ",[21,91,39],{},", with derived ",[21,94,43],{},[21,96,97],{},"FINDINGS-DETAIL.md",[21,99,100],{},"NEEDS-VALIDATION.md"," for human and agent readers respectively. The design deliberately keeps the human readable reports separate from the machine readable ledgers so both audiences get what they need.",[14,103,105],{"id":104},"license","License",[10,107,108],{},"The project is MIT licensed, fully open, and free for commercial and private use, including adapting it into your own security pipeline or forking it to match your internal standards.",[14,110,112],{"id":111},"why-it-is-trending","Why it is trending",[10,114,115,116,28,121,125],{},"It lands squarely on the agent skills plus shift left security wave of 2026, backed by Cloudflare and derived from an enterprise grade harness, packaging what used to be a big tech only audit process into a skill anyone can reuse. It gained about 2548 stars on its launch day, the top of that week ranking. If you like the idea of turning hard won experience into reusable agent skills, see ",[117,118,120],"a",{"href":119},"/post/71/","What Is mattpocock/skills and How to Use It",[117,122,124],{"href":123},"/post/105/","What Is google/skills and How to Use It",". They share the approach but differ in focus, one on engineering skills, one on cloud and AI operations, and this one on security auditing.",[14,127,129],{"id":128},"where-to-find-it","Where to find it",[10,131,132,133,138,139,143],{},"GitHub repo ",[117,134,135],{"href":135,"rel":136},"https://github.com/cloudflare/security-audit-skill",[137],"nofollow"," , with a companion blog post at ",[117,140,141],{"href":141,"rel":142},"https://blog.cloudflare.com/build-your-own-vulnerability-harness",[137]," .",[14,145,147],{"id":146},"getting-started","Getting started",[10,149,150,151,153,154,156,157,159],{},"Read ",[21,152,73],{}," first to understand the six stages and the ledger, then load the skill into an Agent Skills capable agent and run a first audit on a small repo you know well. Focus on the ",[21,155,54],{}," tier so you are not overwhelmed by ",[21,158,58],{}," items, and once the flow feels smooth, wire it into CI for periodic scans. Treat the ledger as a living document, and review the diff between runs to see what changed in your code and your coverage.",[14,161,163],{"id":162},"faq","FAQ",[10,165,166,170],{},[167,168,169],"strong",{},"Isn't this just a normal SAST scanner?"," No. It is closer to an audit methodology with reusable scaffolding, emphasizing isolation, coverage, and independent verification rather than one command that emits a wall of warnings.",[10,172,173,176],{},[167,174,175],{},"Can an ordinary developer use it?"," Yes. As long as your agent supports Agent Skills loading, you can attach this skill and let it audit your own repositories following the six stage flow.",[10,178,179,182],{},[167,180,181],{},"Does it produce many false positives?"," The design uses verifier disproval and independent verification to suppress noise, and it reports confirmed, needs_validation, and rejected tiers so you can start with confirmed only.",[10,184,185,188,189,28,191,193],{},[167,186,187],{},"Should I commit the ledger to the repo?"," It helps. Committing ",[21,190,31],{},[21,192,35],{}," lets the next run build incrementally and gives reviewers a historical view of your audit coverage.",{"title":195,"searchDepth":196,"depth":196,"links":197},"",2,[198,199,200,201,202,203,204,205],{"id":16,"depth":196,"text":17},{"id":47,"depth":196,"text":48},{"id":66,"depth":196,"text":67},{"id":104,"depth":196,"text":105},{"id":111,"depth":196,"text":112},{"id":128,"depth":196,"text":129},{"id":146,"depth":196,"text":147},{"id":162,"depth":196,"text":163},"md",{},true,"/post/104",{"description":12},"post/104","2Ogo_w5aLAIvOGZRsvZTS3grMp-YttnUewJHx7-XumA",1794378304526]