# security-audit

A coding-agent skill that runs a structured, multi-phase security audit, using isolated agents for reconnaissance, hunting, candidate validation and independent verification, producing machine-readable findings.

security-audit is a coding-agent skill that turns an agent into a security auditor. It orchestrates isolated agents through six phases: reconnaissance that maps architecture, trust boundaries and input surfaces; coverage-led hunting, where isolated hunters work from a coverage ledger and coverage critics look for gaps; candidate validation, where a fresh verifier tries to disprove each unique candidate; structured output of confirmed, needs-validation and rejected records validated against a report schema; independent verification of final source claims by fresh agents; and target-neutral reporting derived from the verified records.

Findings carry distinct verdicts: a confirmed finding has a complete source trace and a bounded observed result, a needs-validation finding has an exact unresolved fact with no assigned severity, and a rejected finding records a disproved candidate. Running the skill again against the same repository is additive, reusing prior ledgers and findings to target gaps and revalidate changed source rather than repeating already-covered work.

It is the single-repository skill that seeded a larger, fleet-wide vulnerability discovery harness at Cloudflare. It is written in JavaScript and licensed under the MIT license.

Website: https://github.com/cloudflare/security-audit-skill