Cloudflare Security Audit Skill: evidence-led reviews for coding agents
Reading the findings validator: bounded input before report semantics
Inspect size limits, JSON preflight and diagnostic handling without mistaking validation for proof.
What you will learn
- Bound input before parsing
- Use a deliberate schema subset
- Constrain diagnostics too
Before you start
- Source review and JSON knowledge
- Explicit target authorization and isolation planning
A proposed learning project keeps source revisions, coverage gaps and verdicts visible.
Key takeaways
- Limits precede JSON parsing.
- The schema interpreter has a defined subset.
- A passing record is not a proven finding.
Bound input before parsing
The inspected findings validator limits input to 5 MiB and nesting to 64. Its command path reads bounded input, runs structural preflight, parses JSON and then validates the document.
Other declared limits include 1,000 array items and 100 validation errors. These are limits in the pinned implementation, not measurements of safe throughput on every machine.
Use a deliberate schema subset
The validator implements the JSON Schema keywords needed by its report schema. It has an explicit supported-keyword set and reports unsupported schema keywords instead of claiming to be a general-purpose schema engine.
Uniqueness handling also has budgets for canonical keys and sets. Those controls address report-processing work; they do not validate a source trace against the target program.
Constrain diagnostics too
Diagnostic helpers escape unsafe characters and clip quoted strings. This matters when filenames or record content are supplied by an untrusted source and later appear in terminal output.
This chapter follows selected input and validation paths only. The upstream test suite was not run here, and the presence of limits does not establish that every parser edge case is safe.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Read the limits and command entry path.
- 2
Separate structural validation from factual verification.
- 3
Review diagnostic output as another boundary.
Copy-ready example
bounded file read
-> structural preflight
-> JSON.parse
-> document validation
-> bounded, escaped diagnosticsFrequently asked questions
Is this a universal JSON Schema library?
No. It implements the subset needed by the project.
Were upstream validator tests executed?
No. This chapter reports source inspection.
Sources
- Security Audit Skill / skills/security-audit/validate-findings.cjsSource checked 2026-09-23