This GitHub repo provides a coding-agent skill that runs automated security audits in six phases—recon, hunting, validation, reporting, structured output, and independent verification—to identify exploitable vulnerabilities. It uses parallel agents to generate and disprove findings, outputs structured JSON conforming to a schema, and independently verifies each claim against the source code. Each run reads prior findings to skip known issues and improve coverage.

• Cloudflare open-sourced the actual skill behind their own vulnerability discovery harness, structured as six phases: recon, hunting, validation, reporting, structured output, and independent verification.
• Findings are adversarially checked—the agent that finds a bug never validates it, and separate fresh agents re-verify each claim against the source code before reporting.
• A single audit pass only catches about half of total vulnerabilities, so the tool reads prior findings.json runs to skip known issues and improve coverage over repeated runs.
• Output is enforced as machine-readable JSON validated against a schema via a zero-dependency Node.js script, alongside human-readable REPORT.md and FINDINGS-DETAIL.md files.