Security audits for a coding agent
Three verdicts.
One of them uncomfortable.
A finding is not confirmed because an agent said so. Every candidate goes to a fresh verifier whose job is to disprove it.
npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit
findings.json
Schema validated- confirmed
- Traced and boundedA complete source trace and a bounded observed result.
- needs_validation
- Named, and left openAn exact unresolved fact, and deliberately no severity.
- rejected
- Disproved, and keptA candidate that did not survive its verifier.
The middle verdict is the honest one: an audit that cannot resolve a fact says so instead of guessing a severity.
Runs are additive, using prior ledgers to target gaps rather than re-reporting stale work.