A multi-phase security-audit skill for coding agents that produces machine-readable findings, verifies them independently, and derives target-neutral reports from structured evidence.
This repository provides a coding-agent skill that turns an agent into a security auditor. It is organized around a six-phase audit workflow, with dedicated files for reconnaissance, hunting, validation, reporting, and schema/ledger validation. The README also states that this skill was the single-repo starting point for Cloudflare's broader vulnerability discovery harness.
It addresses the difficulty of running security audits in a disciplined, repeatable way: finding gaps systematically, separating candidate issues from confirmed ones, and keeping outputs structured enough for later verification and reporting. It also tries to avoid treating stale or unresolved work as if it were already covered.
At a high level, the skill guides the agent through reconnaissance, coverage-led hunting, candidate validation, structured recording, independent record verification, and reporting. It uses ledgers and finding records to track what was checked, where gaps remain, and which claims have been independently confirmed or rejected; later runs can reuse prior ledgers and findings to focus on changed areas and remaining gaps.
It is gaining attention because it sits at the intersection of AI coding agents and security work, and the README connects it to Cloudflare's vulnerability discovery harness. The repository is also seeing a noticeable burst of interest in the metadata, with 7,312 stars and 927 gained today, which suggests strong current momentum around agent-driven security auditing.
The README does not name direct competing projects. Comparable approaches, based on what is described here, would be manual security reviews, ad hoc pen-testing prompts for coding agents, or broader multi-stage vulnerability-hunting harnesses built on similar agent orchestration ideas.
AI-explained · grounded in each repo's README