Cloudflare open-sources security-audit-skill: a six-phase multi-agent security audit skill

The skill breaks an audit into six phases: reconnaissance outputs architecture.md and coverage-ledger.json; coverage hunting assigns isolated hunters per ledger unit and records checks; candidate validation assigns each candidate a fresh verifier that tries to falsify it; structured output writes results to findings.json, validated via report-schema.json; independent record verification has a fresh agent confirm sourced claims; and finally it generates REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md. The parent agent runs validate-coverage-ledger.cjs after creating the ledger and after each update, and validate-findings.cjs in phase four and after each replacement in phase five. Security teams and engineers using coding agents like Claude Code can install the skill and trigger the audit flow with commands such as "security audit this codebase," with output defaulting to ~/security-audit-skill/<repo-name>/run-<N>. Verdicts are three-tiered: confirmed, needs_validation, and rejected. Confirmed requires full source tracing and bounded observations; needs_validation records only unresolved precise facts without a severity rating. The skill requires a runtime with a model supporting tool calls and parallel subagents, Node.js, and an OS-level sandbox; without a sandbox that disables external network, limits resources, and restricts writes, the flow keeps leads as needs_validation rather than executing target code. Repeated audits of the same repo accumulate, reusing prior ledgers and findings to locate gaps and re-verify changed source.