{"id":"nr-cloudflare-open-sources-a-six-phase-security-audit-skill-a4e8d6","slug":"cloudflare-open-sources-a-six-phase-security-audit-skill-a4e8d6","title":"Cloudflare open-sources a six-phase security audit skill for coding agents","observed_at":"2026-09-18T13:40:45.45798+00:00","record_date":"2026-09-18","date_kind":"observed_at","novelty":"new","source_platform":"github.com","topics":["security","coding-agents","agent-skills"],"entities":["Cloudflare","security-audit-skill"],"related_patterns":[],"source_url":"https://github.com/cloudflare/security-audit-skill","source_urls":["https://github.com/cloudflare/security-audit-skill"],"basket":{"id":"0325e6b8-f527-4f9b-bfa3-3f30e57f380b","revision":1,"cluster_id":"a4e8d638-4715-4866-8b90-5ec04e078e15"},"type":"post","description":"Cloudflare published security-audit, an MIT-licensed coding-agent skill that runs repository audits in six phases with adversarial validation and schema-checked findings.","why_it_matters":"Useful evidence would be published comparisons of confirmed findings against known vulnerabilities, along with reports from teams operating the required sandbox.","verification_level":"source-inspected","signal_type":"field_note","schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:cloudflare-open-sources-a-six-phase-security-audit-skill-a4e8d6","retrieval_nugget":"Cloudflare published security-audit, an MIT-licensed coding-agent skill that runs repository audits in six phases with adversarial validation and schema-checked findings. Cloudflare has published security-audit, an MIT-licensed coding-agent skill that audits a single repository in six phases: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. The repository describes it as the single-repo starting point that seeded","status":"published","visuals":[],"editorial_provenance":{"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:7b8b0c212e83f263756e085f5a693894ede3fa26ded8085c9d11f985a7b351a2","reviewed_at":"2026-09-24T13:28:46Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":1,"watch_condition_count":1,"related_record_count":0},"analysis":{"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"The design treats a security audit as a pipeline of separated roles rather than a single prompt.","observed_facts":[{"text":"The skill runs a structured audit in six phases, from reconnaissance to target-neutral reporting.","source_urls":["https://github.com/cloudflare/security-audit-skill"]},{"text":"Every unique candidate finding is given to a fresh verifier that tries to disprove it.","source_urls":["https://github.com/cloudflare/security-audit-skill"]},{"text":"Without an OS-enforced sandbox, the workflow keeps a lead as needs_validation instead of executing target code.","source_urls":["https://github.com/cloudflare/security-audit-skill"]}],"mechanism":"Isolated hunters work from units in a coverage ledger, every unique candidate goes to a fresh verifier that tries to disprove it, and findings are written as confirmed, needs_validation, or rejected records that zero-dependency Node.js validators check against a JSON schema.","why_now":"The timing matters because teams are starting to hand security review to coding agents that can plan work, spawn parallel sub-agents, and write their own artifacts.","implications":["One implication is that agent audits can produce machine-readable, schema-validated records that later runs extend, since repeated runs reuse prior ledgers and findings to target gaps."],"evidence_boundary":"The repository does not establish recall or false-positive rates on independent codebases, and its published principles only state that multiple runs improve coverage.","watch_conditions":["Useful evidence would be published comparisons of confirmed findings against known vulnerabilities, along with reports from teams operating the required sandbox."],"related_records":[],"new_branch_reason":"A published, multi-phase agent audit workflow with independent verification is a reusable pattern distinct from single-prompt vulnerability scanning."},"routes":{"html":"https://newruntime.com/posts/cloudflare-open-sources-a-six-phase-security-audit-skill-a4e8d6/","markdown":"https://newruntime.com/posts/cloudflare-open-sources-a-six-phase-security-audit-skill-a4e8d6.md","json":"https://newruntime.com/posts/cloudflare-open-sources-a-six-phase-security-audit-skill-a4e8d6.json"},"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"next_reads":[{"type":"topic","path":"/topics/security/","url":"https://newruntime.com/topics/security/","title":"Security","reason":"Explore the security topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/security.md","json_url":"https://newruntime.com/topics/security.json"},{"type":"topic","path":"/topics/coding-agents/","url":"https://newruntime.com/topics/coding-agents/","title":"Coding Agents","reason":"Explore the coding-agents topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/coding-agents.md","json_url":"https://newruntime.com/topics/coding-agents.json"},{"type":"topic","path":"/topics/agent-skills/","url":"https://newruntime.com/topics/agent-skills/","title":"Agent Skills","reason":"Explore the agent-skills topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/agent-skills.md","json_url":"https://newruntime.com/topics/agent-skills.json"},{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}