一项编码代理技能，能让你的代理变成安全审计员。它通过侦察、覆盖率主导的狩猎、候选人验证、结构化输出、独立记录核验和目标中立报告来协调孤立的代理。

正是这项技能催生了Cloudflare的漏洞发现工具，该工具在《自建漏洞工具》中有描述。该工具发展成一个多阶段、全舰队的系统;该技能是其单仓库的起点。

它的作用

该技能将进行结构化审计，分为六个阶段：

1. 侦察——地图架构、信任边界、输入曲面、先验证据及确定性覆盖，内容涵盖architecture.md和coverage-ledger.json。
2. 覆盖主导狩猎——从账本单元分配孤立猎人，记录他们的检查，并利用覆盖批评者寻找空隙。
3. 候选验证——将每个唯一候选人交给一个试图推翻其结果的全新验证者。
4. 结构化输出——将记录写入confirmed、needs_validation和rejected，并与report-schema.json进行验证。

security-audit

A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.

This is the skill that seeded Cloudflare’s vulnerability discovery harness, described in Build your own vulnerability harness. The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.

What it does

The skill runs a structured audit in six phases:

1. Reconnaissance – map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json.
2. Coverage-led hunting – assign isolated hunters from ledger units, record their checks, and use coverage critics to find gaps.
3. Candidate validation – give every unique candidate to a fresh verifier that tries to disprove it.
4. Structured output – write confirmed, needs_validation, and rejected records to findings.json and validate them against report-schema.json.
5. Independent record verification – fresh agents verify final source claims. Material replacements receive another independent verifier.
6. Target-neutral reporting – derive REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from the verified records and coverage ledger.

The parent runs validate-coverage-ledger.cjs after creating the ledger and after each later ledger update. It runs validate-findings.cjs in Phase 4 and again after every Phase 5 replacement.

The verdicts are distinct: confirmed has a complete source trace and bounded observed result, needs_validation has an exact unresolved fact and no severity, and rejected records a disproved candidate.

Multiple runs against the same repo are additive. The skill uses prior ledgers and findings to target gaps, revalidate changed source, and carry forward current-source evidence without treating stale or unresolved work as covered.

Files