cloudflare-security-audit-skill

Skill by ara.so — Security Skills collection.

A coding-agent skill that orchestrates multi-phase security audits through parallel agents. It runs six phases: reconnaissance, hunting, adversarial validation, reporting, structured output generation, and independent verification. Designed to find exploitable vulnerabilities with real impact, not theoretical issues.

This is the open-source skill that seeded Cloudflare's vulnerability discovery harness. Multiple runs against the same codebase are additive—each explores different attack surfaces while reading prior findings to avoid duplicates.

What it does

The skill coordinates multiple parallel agents through a structured pipeline:

1. Recon — Maps architecture, trust boundaries, input surfaces → architecture.md
2. Hunt — 7 parallel agents attack from different angles (injection, access control, business logic, crypto, feature abuse, chained attacks, wildcard)
3. Validate — Separate agents adversarially review each finding to eliminate false positives
4. Report — Generates REPORT.md and FINDINGS-DETAIL.md
5. Structured output — Produces findings.json validated against report-schema.json
6. Independent verification — Fresh agents verify every claim against actual source code