Cloudflare 团队把其内部找漏洞的那套方法做成了一个 Skill，叫 security-audit，并开源了。
This is a dev post classified by Jev as Security (a tool drop), kept by the Dev Radar because it carries real work, not commentary.
Cloudflare 团队把其内部找漏洞的那套方法做成了一个 Skill，叫 security-audit，并开源了。 装进编码 Agent 就能对自己的代码库跑一次正经的安全审计，已斩获 11000+ Star！ 流程分 6 个阶段，先摸清架构和信任边界，再派出多个独立的 Agent 分片去找，每个候选漏洞交给一个新的 Agent 专门去推翻它。 GitHub：http://github.com/cloudflare/security-audit-skill 它的规矩是找到的那个 Agent 不能自己验，验证阶段的目标就是证明这条不成立，最后只有三种结论，确认、待核实、已排除。 待核实的会写清卡在哪个具体事实上，不给严重程度。少了一层防护但另一层挡得住的，只算加固建议，不算漏洞。 产出是一份主报告加一份逐条细节，每条确认的都能追溯到源码位置。 Cloudflare 博客说这就是他们内部漏洞发现系统的起点，多跑几次结果会叠加，他们自己测下来单跑一次大概只能找到一半。 用法就一句「security audit this codebase」，在自己有权限审的代码库上跑，把结果当一份第二意见看，我觉得比裸问 Agent 靠谱得多。
Posted by GitHubDaily (84.6k followers) 7 h ago · 101 likes · 7.5k views · view the original post on X. Kept by the Dev Radar as Security. Tools mentioned: security-audit-skill.
More dev work like this
- Wow, these slides are fantastic to just read through and contemplate. 😍… — @zooko
- Dostlar selamlar, globaldeki en büyük Cybersecurity SFT finetuning datasetlerinden olan… — @AlicanKiraz0
- Scans emails and usernames across 715+ platforms to map digital footprints and verify… — @tom_doerr
- DeepTeam runs locally to simulate attacks and uncover vulnerabilities in LLM systems. — @tom_doerr
- Software now writes and runs software: — @jfrog
- Ok, jev is really cool. So many great use cases where a fast and accurate yes/no gate… — @andrelandgraf
- Running security telemetry across 170,000 cloud resources can overload infrastructure. — @CloudNativeFdn
- Your agent’s memory can become an attack surface. This repo helps you guard it. — @DanKornas
Every post is read and classified by Jev (TypeSafe): what it is, which market it belongs to, and whether the link is a real tool. 12.2k posts from 4.7k X accounts over the last 21 days, 1.3k tools, 12 markets. Collected every 5 minutes, fully re-ranked every hour — last update 2026-09-19 17:33 UTC. Full method.