Cloudflare Security Audit Skill: evidence-led reviews for coding agents
Security Audit Skill architecture: coverage and verdicts are separate states
Follow the ledger and findings records through validation without equating activity with coverage.
What you will learn
- Track what was examined
- Track what was established
- Keep old evidence tied to source
Before you start
- Source review and JSON knowledge
- Explicit target authorization and isolation planning
A proposed learning project keeps source revisions, coverage gaps and verdicts visible.
Key takeaways
- Coverage status differs from finding verdict.
- Fresh review checks source claims.
- Stale evidence does not cover changed code.
Track what was examined
The coverage ledger tracks surfaces, boundaries, subsystems and attack classes along with reviewed paths, local checks and unresolved work. Its statuses include planned, in_progress, covered, candidate, blocked and deferred.
A covered unit describes a coverage decision; a candidate signals a lead. Neither label by itself establishes a confirmed vulnerability or a globally safe repository.
Track what was established
Findings use a different verdict system: confirmed, needs_validation or rejected. The README assigns fresh verifiers to candidate validation and independent source-claim review before reports are derived.
Validate the ledger after updates and findings after structured output and replacements. Syntax and consistency checks help preserve records across handoffs, while factual verification remains a separate responsibility.
Keep old evidence tied to source
Repeated runs are additive: they can revisit gaps and changed source. Prior evidence should not count as current coverage merely because a previous run produced a report.
Record source changes, blocked work and unresolved facts explicitly. This series did not run the multi-agent orchestration, so it does not quantify how much coverage repeated runs would add.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Map scope into ledger units.
- 2
Maintain separate finding verdicts.
- 3
Revalidate evidence when source changes.
Copy-ready example
coverage: planned -> in_progress -> covered / candidate / blocked
findings: confirmed | needs_validation | rejected
source change -> revalidation requiredFrequently asked questions
Does covered mean vulnerability-free?
No. It records a scoped coverage decision.
Can old findings be reused unchanged?
Only evidence still valid for current source can be carried forward.
Sources
- Security Audit Skill / README.mdSource checked 2026-09-23
- Security Audit Skill / skills/security-audit/validate-coverage-ledger.cjsSource checked 2026-09-23