Cloudflare 把那套内部挖漏洞的打法，直接打包成了一个 Skill，取名 security-audit，还开源了——如今 Star 已经冲到 11000+。
This is a dev post classified by AGK Intelligence as Security (a tool drop), kept by the Dev Radar because it carries real work, not commentary.
Cloudflare 把那套内部挖漏洞的打法，直接打包成了一个 Skill，取名 security-audit，还开源了——如今 Star 已经冲到 11000+。 对普通开发者来说，意义在哪？把这个 Skill 塞进你的编码 Agent，它就能对自家代码库跑一轮像样的安全审计，而不是随口问一句“有没有漏洞”那种敷衍操作。 我真正服气的是它定的几条规矩： 1️⃣ 谁发现漏洞，谁就不许自己验证，另起一个全新 Agent 专门负责推翻它，摆明了就是要抬杠挑刺 2️⃣ 结论只给三种——确认、待核实、已排除，凡是“待核实”的，得写明白卡在哪个事实上，绝不和稀泥 3️⃣ 少了一道防护但另一道还挡得住的，只算加固建议，不按漏洞上报 按 Cloudflare 自己的实测，单独跑一遍大概只能捞到一半，多跑几轮结果能互相叠加上去。 使用成本低到就一句 security audit this codebase，当成第二意见来用，比直接干问 Agent 靠谱太多。 🔗 https://github.com/cloudflare/security-audit-skill
Posted by lumxss (33k followers) 1 days ago · 10 likes · 1.2k views · view the original post on X. Kept by the Dev Radar as Security. Tools mentioned: security-audit-skill.
More dev work like this
- #PHP2Shell. The #LiteLLM supply chain compromise. #Brotli2Shell. — @jfrog
- CVE-2024-21413: MonikerLink Outlook Vulnerability PoC — @DarkWebInformer
- CrowdStrike President Michael Sentonas joined Sascha Roehrer on deeptech INSIGHTS to… — @CrowdStrike
- I just shared this with my family, and you all should do it too. — @JJEnglert
- Securing AI shouldn't add complexity. — @PaloAltoNtwks
- Standing room only at the Boston Kubernetes Meetup last night for Teleport’s Paul Curtis… — @goteleport
- AI adoption is accelerating. Stopping emerging AI threats takes elite expertise. — @CrowdStrike
- Names, emails, API keys—Our ambassador @povedaai is putting MiniCPM4-0.5B to work… — @OpenBMB
Every post is read and classified by AGK Intelligence: what it is, which market it belongs to, and whether the link is a real tool. 31.2k posts from 5k X accounts over the last 21 days, 8.8k tools, 12 markets. New posts are collected several times an hour and the full ranking is recomputed every hour — last update 2026-10-30 21:12 UTC. Full method.