Cloudflare Security Audit Skill: evidence-led reviews for coding agents
Build a read-only audit evidence viewer
A proposed learning project keeps source revisions, coverage gaps and verdicts visible.
What you will learn
- Start with existing records
- Design useful distinctions
- Define completion by review tasks
Before you start
- Source review and JSON knowledge
- Explicit target authorization and isolation planning
A proposed learning project keeps source revisions, coverage gaps and verdicts visible.
Key takeaways
- The viewer is a proposed extension.
- Read-only import should remain inert.
- Coverage and verdicts need separate views.
Start with existing records
Build a local viewer for copies of coverage and findings records from an authorized exercise. Preserve the source revision and validation status beside every record so old evidence remains distinguishable.
This is a proposed extension, not a feature implemented in this series. Begin read only: importing a report should never execute its commands or silently change its verdicts.
Design useful distinctions
Give covered units, blocked units and candidate records separate views. Show needs_validation with the exact unresolved fact, and keep severity absent where the workflow requires it.
Link source references as data with safe rendering. Avoid evaluating embedded HTML or launching shell commands from a finding, and retain the original record for comparison.
Define completion by review tasks
Ask a reviewer to locate the target revision, identify an uncovered boundary and explain why one candidate remains unresolved. Record whether the interface supports those tasks without hiding rejected leads.
Use synthetic records when demonstrating the viewer publicly. No user study or viewer implementation was completed here; the acceptance plan is intended to guide a later, separately scoped project.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Import copies without execution.
- 2
Expose source revision and unresolved facts.
- 3
Test concrete reviewer tasks on synthetic records.
Copy-ready example
viewer_proposal:
mode: read-only
imported_commands: never-execute
source_revision: visible
unresolved_facts: visible
public_demo: synthetic-recordsFrequently asked questions
Is this an existing repository feature?
No, it is a proposed learning project.
Can the viewer run reproduction commands?
The proposed first version is read only and must not execute imported content.
Sources
- Security Audit Skill / README.mdSource checked 2026-09-23
- Security Audit Skill / skills/security-audit/validate-coverage-ledger.cjsSource checked 2026-09-23
- Security Audit Skill / skills/security-audit/validate-findings.cjsSource checked 2026-09-23