エージェントをセキュリティ監査人に変えるコーディングエージェントスキル。偵察、カバレッジ主導のハンティング、候補者検証、構造化出力、独立記録検証、ターゲット中立報告を通じて孤立エージェントを調整する。

このスキルはCloudflareの脆弱性発見ハーネスの種となり、『Build your own vulnerability harness』で説明されています。このハーネスは多段階のフリート全体システムへと成長しました。このスキルは、シングルリポジトリから進化した出発点となっています。

それが何をするのか

このスキルは6つのフェーズに分かれた構造化された監査を実行します。

1. 偵察 – 地図のアーキテクチャ、信頼境界、入力面、事前証拠、決定論的カバレッジ(architecture.mdおよびcoverage-ledger.json)。
2. カバレッジ主導の狩猟 – 台帳ユニットから孤立したハンターを割り当て、そのチェックを記録し、カバレッジ批評家を使って隙間を見つけます。
3. 候補者検証 – すべての一意候補を新しい検証者に渡し、それを否定しようとする。
4. 構造化出力 – confirmed、needs_validation、rejectedのレコードをfindings.json]]に書き、それらをreport-schema.json]と照らして検証します。

security-audit

A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.

This is the skill that seeded Cloudflare’s vulnerability discovery harness, described in Build your own vulnerability harness. The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.

What it does

The skill runs a structured audit in six phases:

1. Reconnaissance – map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json.
2. Coverage-led hunting – assign isolated hunters from ledger units, record their checks, and use coverage critics to find gaps.
3. Candidate validation – give every unique candidate to a fresh verifier that tries to disprove it.
4. Structured output – write confirmed, needs_validation, and rejected records to findings.json and validate them against report-schema.json.
5. Independent record verification – fresh agents verify final source claims. Material replacements receive another independent verifier.
6. Target-neutral reporting – derive REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from the verified records and coverage ledger.

The parent runs validate-coverage-ledger.cjs after creating the ledger and after each later ledger update. It runs validate-findings.cjs in Phase 4 and again after every Phase 5 replacement.

The verdicts are distinct: confirmed has a complete source trace and bounded observed result, needs_validation has an exact unresolved fact and no severity, and rejected records a disproved candidate.

Multiple runs against the same repo are additive. The skill uses prior ledgers and findings to target gaps, revalidate changed source, and carry forward current-source evidence without treating stale or unresolved work as covered.

Files