This GitHub repo provides a coding-agent skill that runs automated security audits in six phases—recon, hunting, validation, reporting, structured output, and independent verification—to identify exploitable vulnerabilities. It uses parallel agents to generate and disprove findings, outputs structured JSON conforming to a schema, and independently verifies each claim against the source code. Each run reads prior findings to skip known issues and improve coverage.

• Cloudflare open-sourced the actual skill behind their own vulnerability discovery harness, structured as six phases: recon, hunting, validation, reporting, structured output, and independent verification.
• Findings are adversarially checked—the agent that finds a bug never validates it, and separate fresh agents re-verify each claim against the source code before reporting.
• A single audit pass only catches about half of total vulnerabilities, so the tool reads prior findings.json runs to skip known issues and improve coverage over repeated runs.
• Output is enforced as machine-readable JSON validated against a schema via a zero-dependency Node.js script, alongside human-readable REPORT.md and FINDINGS-DETAIL.md files.

This Dev newsletter covers American Express’s cell-based payment system for high availability, a persistent agent memory layer on Elasticsearch, and a large-scale malware campaign on GitHub. It also highlights AI agent security roadmaps, GDPR consent fines, compiler reproducibility fixes, and new autonomous agent frameworks.

• A team built persistent agent memory by layering episodic/semantic/procedural Elasticsearch indices, hitting 0.89 recall with zero cross-tenant leaks
• Attackers flooded GitHub with 10,000 malicious repos hiding Trojans in ZIPs, constantly swapping readme links and commits to outpace detection
• Norway's DPA fined Elkjop €1.8 million for illegally forcing marketing consent as a condition of customer sign-up, a clear GDPR violation
• American Express uses a cell-based architecture where independent processing "cells" isolate failures so one crash doesn't cascade across the payments system