에이전트를 보안 감사관으로 만드는 코딩 에이전트 기술. 정찰, 커버리지 주도 사냥, 후보자 검증, 구조화된 출력, 독립 기록 검증, 목표 중립 보고 등을 통해 고립된 에이전트들을 조율합니다.

이 기술은 Cloudflare의 취약점 발견 하네스(취약점 발견 하네스)의 씨앗이 되었으며, 'Build your own vulnerability harness’에 설명되어 있습니다. 이 하네스는 다단계 플릿 전체 시스템으로 성장했으며; 이 스킬이 단일 저장소 출발점이 되었습니다.

그것이 하는 일들

이 스킬은 6단계로 구성된 구조화된 감사를 수행합니다:

1. 정찰 – 지도 구조, 신뢰 경계, 입력 표면, 사전 증거, 결정론적 커버리지(architecture.md와 coverage-ledger.json.
2. 커버리지 주도 사냥 – 레저 단위에서 고립된 사냥꾼을 배정하고, 그들의 체크를 기록하며, 커버리지 비평가를 활용해 빈틈을 찾는다.
3. 후보 검증 – 모든 고유 후보를 반증하려는 새로운 검증자에게 부여합니다.
4. 구조화 출력 – confirmed, needs_validation, rejected 레코드를 findings.json]에 기록하고 report-schema.json와 대조하여 검증합니다.

security-audit

A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.

This is the skill that seeded Cloudflare’s vulnerability discovery harness, described in Build your own vulnerability harness. The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.

What it does

The skill runs a structured audit in six phases:

1. Reconnaissance – map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json.
2. Coverage-led hunting – assign isolated hunters from ledger units, record their checks, and use coverage critics to find gaps.
3. Candidate validation – give every unique candidate to a fresh verifier that tries to disprove it.
4. Structured output – write confirmed, needs_validation, and rejected records to findings.json and validate them against report-schema.json.
5. Independent record verification – fresh agents verify final source claims. Material replacements receive another independent verifier.
6. Target-neutral reporting – derive REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from the verified records and coverage ledger.

The parent runs validate-coverage-ledger.cjs after creating the ledger and after each later ledger update. It runs validate-findings.cjs in Phase 4 and again after every Phase 5 replacement.

The verdicts are distinct: confirmed has a complete source trace and bounded observed result, needs_validation has an exact unresolved fact and no severity, and rejected records a disproved candidate.

Multiple runs against the same repo are additive. The skill uses prior ledgers and findings to target gaps, revalidate changed source, and carry forward current-source evidence without treating stale or unresolved work as covered.

Files