README

security-audit

A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.

This is the skill that seeded Cloudflare's vulnerability discovery harness, described in Build your own vulnerability harness. The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.

 What it does

The skill runs a structured audit in six phases:

1. Reconnaissance -- map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json.
2. Coverage-led hunting -- assign isolated hunters from ledger units, record their checks, and use coverage critics to find gaps.
3. Candidate validation -- give every unique candidate to a fresh verifier that tries to disprove it.
4. Structured output -- write confirmed, needs_validation, and rejected records to findings.json and validate them against report-schema.json.
5. Independent record verification -- fresh agents verify final source claims. Material replacements receive another independent verifier.
6. Target-neutral reporting -- derive REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from the verified records and coverage ledger.

The parent runs validate-coverage-ledger.cjs after creating the ledger and after each later ledger update. It runs validate-findings.cjs in Phase 4 and again after every Phase 5 replacement.

The verdicts are distinct: confirmed has a complete source trace and bounded observed result, needs_validation has an exact unresolved fact and no severity, and rejected records a disproved candidate.

Multiple runs against the same repo are additive. The skill uses prior ledgers and findings to target gaps, revalidate changed source, and carry forward current-source evidence without treating stale or unresolved work as covered.

 Files

| File | Purpose |
|------|---------|
| SKILL.md | Setup, core principles, platform terminology, workflow overview, and audit anti-patterns |
| RECONNAISSANCE.md | Phase 1 reconnaissance prompts and synthesis instructions |
| HUNTING.md | Phase 2 orchestration, hunting methodology, and validation rules |
| ATTACK-CLASSES.md | Core, wildcard, and obvious-things attack prompts |
| MEMORY-SAFETY-AND-BINARY.md | Memory-safety, binary, and kernel hunting classes for native targets |
| AI-AND-LLM.md | Prompt-injection, agent/tool, and output-handling hunting classes for LLM-backed targets |
| WEB-PROTOCOL-AND-AUTH.md | HTTP request-framing, cache, and authentication-protocol hunting classes for HTTP-protocol and auth targets |
| CLIENT-SIDE.md | DOM-injection, messaging-trust, UI-redress, and prototype-pollution hunting classes for client-side/browser targets |
| SUPPLY-CHAIN-AND-RELEASE.md | Dependency, CI, release, signing, update, plugin, and extension hunting 

Top issues