🔥 cloudflare/security-audit-skill：面向编码 Agent 的多阶段安全审计技能

一项可将你的 Agent 转变为安全审计员的编码 Agent 技能。它通过编排相互隔离的 Agent，完成侦察、覆盖率驱动的漏洞挖掘、候选项验证、结构化输出、独立记录核验以及与目标无关的报告生成。

这是孕育出 Cloudflare 漏洞发现 harness 的技能，相关 harness 见 构建你自己的漏洞发现 harness。该 harness 后来发展为一个多阶段、全范围部署的系统；而这项技能则是其演进而来的单仓库起点。

该技能通过六个阶段运行结构化审计：

1. 侦察 —— 在 architecture.md 和 coverage-ledger.json 中梳理架构、信任边界、输入面、既有证据及确定性覆盖范围。
2. 覆盖率驱动的漏洞挖掘 —— 从账本单元分配相互隔离的挖掘 Agent，记录其检查内容，并使用覆盖率审查 Agent 发现缺口。
3. 候选项验证 —— 将每个唯一候选项交给一个新的验证 Agent，由其尝试证伪该候选项。
4. 结构化输出 —— 将 confirmed、needs_validation 和 rejected 记录写入 findings.json，并依据 report-schema.json 对其进行验证。
5. 独立记录核验 —— 由新的 Agent 验证最终的源码声明。存在实质性替换的记录还会获得另一名独立验证者。
6. 与目标无关的报告生成 —— 从已验证记录和覆盖率账本中生成 REPORT.md、FINDINGS-DETAIL.md 和 NEEDS-VALIDATION.md。

父级协调 Agent 会在创建账本后、以及之后每次更新账本后运行 validate-coverage-ledger.cjs。它会在第 4 阶段运行 validate-findings.cjs，并在第 5 阶段每次替换记录后再次运行该程序。

各判定状态彼此明确区分：confirmed 具有完整的源码追踪和边界清晰的已观察结果；needs_validation 包含一个精确但尚未解决的事实，且不标注严重性；rejected 则记录已被证伪的候选项。

针对同一仓库的多次运行可以累积增益。该技能会利用此前的账本和发现结果定位缺口、重新验证已变更的源码，并延续针对当前源码的证据，同时不会将过时或未解决的工作视为已覆盖。

使用 Skills CLI 安装该技能：

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit

使用 --global 可进行用户级安装：

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit \
  --global

运行 npx skills --help 可查看 Agent 选择和非交互式选项。

在你希望审计的代码库中启动编码 Agent（或将 Agent 指向该代码库），然后要求它执行安全审计：

security audit this codebase

find security vulnerabilities in ./src

do a security review, output to ~/audits/my-project

当请求匹配其触发条件时，该技能会自动激活，例如安全审计、查找漏洞、对代码进行渗透测试等。直接请求对代码库进行审计或渗透测试时，会使用完整审计模式。安全问题咨询和聚焦的漏洞分析默认使用指导模式，除非你要求生成报告产物。在完整审计模式下，如未指定输出目录，默认目录为 ~/security-audit-skill/<repo-name>/run-<N>。只有在你明确选择了一个被版本控制系统忽略的目录时，工作流才会在目标仓库内写入文件。

• 一个使用支持工具调用和并行子 Agent 的模型的编码 Agent

• 用于零依赖发现记录和覆盖率账本验证器的 Node.js

• 面向由目标控制的构建、测试、进程、浏览器、模拟器、模糊测试器和 fixture 的、由操作系统强制实施的沙箱。它必须禁用外部网络访问，使用经过净化的白名单环境，执行资源限制，并且仅允许写入分配的临时路径。若不具备这些控制措施，工作流将把线索保留为 needs_validation，而不会执行目标代码。

• 仅确认已确立的边界失效。 对于有源码依据但受阻的线索，应保留为 needs_validation，并记录其精确的未解决事实。

• 对抗性验证。 检查某项发现的 Agent 绝不能是发现该问题的 Agent。

• 严重性需要影响。 严重性取决于可能性 × 影响，而不是偏离检查清单的程度。

• 纵深防御缺口不是漏洞。 如果 A 层能够阻止攻击，缺少 B 层只是加固建议。

• 多次运行可提升覆盖率。 在我们的测试运行中，单次运行发现的漏洞数量约为重复运行最终发现总数的一半。

如有问题、反馈，或希望交流 AI 驱动安全工具的经验，请联系：security-ai-research@cloudflare.com

MIT —— 参见 LICENSE。

A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.

This is the skill that seeded Cloudflare's vulnerability discovery harness, described in Build your own vulnerability harness. The harness grew into a multi-stage, fleet-wide system; this skill is the single-repo starting point it evolved from.

The skill runs a structured audit in six phases:

1. Reconnaissance -- map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json.
2. Coverage-led hunting -- assign isolated hunters from ledger units, record their checks, and use coverage critics to find gaps.
3. Candidate validation -- give every unique candidate to a fresh verifier that tries to disprove it.
4. Structured output -- write confirmed, needs_validation, and rejected records to findings.json and validate them against report-schema.json.
5. Independent record verification -- fresh agents verify final source claims. Material replacements receive another independent verifier.
6. Target-neutral reporting -- derive REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from the verified records and coverage ledger.

The parent runs validate-coverage-ledger.cjs after creating the ledger and after each later ledger update. It runs validate-findings.cjs in Phase 4 and again after every Phase 5 replacement.

The verdicts are distinct: confirmed has a complete source trace and bounded observed result, needs_validation has an exact unresolved fact and no severity, and rejected records a disproved candidate.

Multiple runs against the same repo are additive. The skill uses prior ledgers and findings to target gaps, revalidate changed source, and carry forward current-source evidence without treating stale or unresolved work as covered.

Install the skill with the Skills CLI:

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit

Use --global for a user-level installation:

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit \
  --global

Run npx skills --help for agent-selection and non-interactive options.

Start your coding agent in (or pointed at) the codebase you want to audit, then ask it to do a security audit:

security audit this codebase



find security vulnerabilities in ./src



do a security review, output to ~/audits/my-project

The skill activates automatically when the request matches its trigger (security audit, find vulnerabilities, pen-test the code, etc.). A direct codebase audit or pen-test request uses full audit mode. Security questions and focused vulnerability work use guidance mode unless you request report artifacts. In full audit mode, an unspecified output directory defaults to ~/security-audit-skill/<repo-name>/run-<N>. The workflow writes inside the target repository only when you explicitly select a directory that version control ignores.

• A coding agent with a model that supports tool use and parallel sub-agents

• Node.js for the zero-dependency findings and coverage-ledger validators

• An OS-enforced sandbox for target-controlled builds, tests, processes, browsers, emulators, fuzzers, and fixtures. It must disable external networking, use a sanitized allowlisted environment, enforce resource limits, and allow writes only to assigned scratch paths. Without these controls, the workflow keeps the lead as needs_validation instead of executing target code.

• Only confirm established boundary failures. Keep a source-grounded blocked lead as needs_validation with its exact unresolved fact.

• Adversarial validation. The agent that checks a finding is never the agent that found it.

• Severity requires impact. Likelihood x impact, not deviation from a checklist.

• Defense-in-depth gaps are not vulnerabilities. If Layer A prevents the attack, the absence of Layer B is a hardening note.

• Multiple runs improve coverage. In our test runs, a single run found roughly half of the vulnerabilities that repeated runs found in total.

Questions, feedback, or comparing notes on AI-driven security tooling: security-ai-research@cloudflare.com

MIT -- see LICENSE.