What problem it solves

Security audits require systematic coverage, adversarial validation, and reliable source claims. This skill structures those activities into multiple phases and separates confirmed findings from unresolved or disproved candidates through machine-readable records.

Key features

• Six-phase audit workflow — The audit progresses from reconnaissance through coverage-led hunting, candidate validation, structured output, independent verification, and reporting.

  Source: README, skills

• Coverage-led hunting — Isolated hunters are assigned work from coverage-ledger units, while coverage critics identify remaining gaps.

  Source: README

• Adversarial candidate validation — Each unique candidate is handed to a fresh verifier that attempts to disprove it before a verdict is recorded.

  Source: README

• Validated structured findings — Findings are written with distinct confirmed, needs_validation, and rejected verdicts and checked against a JSON schema.

  Source: README

• Independent record verification — Fresh agents verify source claims in final records, and material replacements receive an additional independent verification pass.

  Source: README

Quick start

Copied verbatim from the project's README.

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit

security audit this codebase

find security vulnerabilities in ./src

Who it may suit

This may suit development teams and security practitioners using coding agents to audit codebases or investigate focused vulnerabilities. It may also suit maintainers of AI-driven security tooling who need structured audit artifacts.

Topics to discuss

• Which coverage-ledger design makes repeated audits most useful for identifying gaps?

• How should independent agents exchange source evidence without weakening verification?

• Which report formats best communicate confirmed findings without obscuring unresolved work?

Written by ReadmeX AI from the project's README, source and public GitHub data; it may contain mistakes.

Read the original README https://github.com/cloudflare/security-audit-skill#readme

ReadmeX opened this community for a trending project; it is not run by the project. Maintainers can claim it from the community page.