GitHub - cloudflare/security-audit-skill is a coding-agent skill that turns an agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. The skill seeded Cloudflare's vulnerability discovery harness, which grew into a multi-stage, fleet-wide system.

The audit runs in six phases. Reconnaissance maps architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json. Coverage-led hunting assigns isolated hunters from ledger units, records their checks, and uses coverage critics to find gaps.

Candidate validation gives every unique candidate to a fresh verifier. Confirmed records have a complete source trace and bounded observed result; needs_validation has an exact unresolved fact and no severity; rejected records are disproved candidates. Fresh agents verify final source claims, with material replacements receiving another independent verifier.

Target-neutral reporting derives REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md. The parent runs validate-coverage-ledger.cjs after ledger creation and updates, and validate-findings.cjs in Phase 4 and after Phase 5 replacements. Multiple runs against the same repo are additive, carrying forward current-source evidence.

The repository includes focused hunting guides for attack classes, memory safety, AI, web protocols, supply chains, cloud deployment, RPC, resource exhaustion, data isolation, desktop and mobile, and validation and reporting. It also contains JSON schemas, zero-dependency validators, and tests.