Cloudflare's security-audit skill, now at 11,882 stars, encodes a six-phase audit with adversarial verifiers that try to disprove each finding
cloudflare/security-audit-skill reached the HN front page on Sep 17 and the GitHub API confirms 11,882 stars and 644 forks, last pushed Sep 14, though the repo was created June 18 alongside Cloudflare's 'Build your own vulnerability harness' post, so this is a surfacing rather than a new release. The skill runs six phases: reconnaissance to map architecture and trust boundaries, coverage-led hunting with isolated hunters, candidate validation where fresh verifiers try to disprove each finding, structured JSON output split into confirmed, needs_validation and rejected, independent record verification by new agents, and target-neutral markdown reporting. The reusable idea for anyone writing their own skill is the adversarial validation loop plus the three-way verdict, which is what kept Cloudflare's fleet-wide harness from drowning in false positives across 128 repos.
↳ Follow the thread