security-audit-skill

Why we included this project

Most coding-agent security reviews stop at a list of suspected problems, with no way to tell a real vulnerability from a false positive. This skill makes the agent earn each finding: parallel recon agents map the application's architecture and trust boundaries, hunters attack the codebase from different angles, and a separate pass tries to disprove every result before it gets reported. Findings come back as validated JSON alongside a human-readable report, and fresh agents independently check each factual claim against the source code. Repeated runs are additive, so the skill reads earlier findings and targets gaps instead of re-reporting known issues. That makes it a practical fit for teams doing ongoing audits of web services, native binaries, and LLM-backed apps without building their own harness, and the fact that it seeded Cloudflare's own vulnerability discovery tooling suggests it has real mileage.