Cloudflare has released a coding-agent skill that automates the process of identifying security vulnerabilities within a codebase. This tool serves as a modular extension for coding agents, providing a structured framework for multi-phase security audits. It evolved from the foundation of Cloudflare's internal vulnerability discovery systems, moving from a single-repository starting point into a fleet-wide system for identifying security flaws.
This image represents the open-source repository where the coding-agent skill is hosted and managed.
The skill operates through a six-phase workflow designed to maintain a rigorous audit trail. It begins with a reconnaissance phase that maps architecture, trust boundaries, and input surfaces to create a 'coverage-ledger.' This ledger tracks which parts of the system have been audited. During the 'coverage-led hunting' phase, the system assigns isolated 'hunter' agents to specific units from the ledger. These agents record their checks while 'coverage critics' identify gaps in the audit. To ensure accuracy, the skill employs adversarial validation: every unique candidate finding is passed to a fresh verifier agent whose specific task is to disprove the finding before it can be confirmed.
To maintain high-quality, machine-readable output, the skill categorizes findings into three distinct verdicts: 'confirmed,' 'needs_validation,' and 'rejected.' A finding is only marked as 'confirmed' if it has a complete source trace and a bounded observed result. A significant technical constraint of this system is its reliance on an OS-enforced sandbox. Because the workflow requires executing target code to verify findings, the agent cannot move a lead from 'needs_validation' to 'confirmed' without a secure environment that disables external networking and enforces resource limits. Without these controls, the system defaults to a 'needs_validation' status to prevent unsafe execution of potentially malicious code during the audit process.