Cloudflare released a coding-agent skill for multi-phase security audits. It orchestrates isolated agents through six phases: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. The skill produces machine-readable findings in `findings.json` validated against `report-schema.json`. It supports additive runs against the same repo to target gaps and revalidate changes. The workflow requires a sandboxed environment to execute target code. The skill is open-source under an MIT license. It can be installed via the Skills CLI. The repository has 60.6k stars and 3.9k forks.
What it unlocks
Running multi-phase security audits with independently verified, machine-readable findings using a coding agent.
- 6 phases
- 60.6k stars
- 3.9k forks
What you need to act on it
- a coding agent with tool use and parallel sub-agents
- Node.js
- an OS-enforced sandbox
Sources