What happens when the AI agent that finds a bug is never allowed to confirm it?
That's the core rule of Cloudflare's security-audit-skill. It turns a coding agent into a 6-phase auditor: recon, coverage-led hunting, adversarial validation, structured output, independent re-verification, reporting.
A fresh agent tries to disprove every candidate. Each finding lands as confirmed, needs_validation or rejected in schema-checked JSON.
Their own note: one run found roughly half of what repeated runs found. Runs are additive.
MIT. ~16k stars this week.
#AISecurity #AIAgents #OpenSource #GitHub