Cloudflare has published security-audit, an MIT-licensed coding-agent skill that audits a single repository in six phases: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. The repository describes it as the single-repo starting point that seeded Cloudflare's larger vulnerability discovery harness, and it installs through the Skills CLI with npx skills add.
The design treats a security audit as a pipeline of separated roles rather than a single prompt. Isolated hunters work from units in a coverage ledger, every unique candidate goes to a fresh verifier that tries to disprove it, and findings are written as confirmed, needs_validation, or rejected records that zero-dependency Node.js validators check against a JSON schema. The agent that checks a finding is never the agent that found it, and target code runs only inside an OS-enforced sandbox without external networking.
The timing matters because teams are starting to hand security review to coding agents that can plan work, spawn parallel sub-agents, and write their own artifacts. One implication is that agent audits can produce machine-readable, schema-validated records that later runs extend, since repeated runs reuse prior ledgers and findings to target gaps. The repository does not establish recall or false-positive rates on independent codebases, and its published principles only state that multiple runs improve coverage.
Useful evidence would be published comparisons of confirmed findings against known vulnerabilities, along with reports from teams operating the required sandbox.