Cloudflare开源安全审计AI代理技能

Cloudflare开源了一个名为Security-Audit-Skill的AI编码代理技能，可将代理转变为安全审计工具，用于发现代码漏洞1。该技能是Cloudflare内部漏洞发现系统的开源版本1。

该审计工具通过六个阶段的结构化流程进行漏洞挖掘，分别为侦察、覆盖率驱动的狩猎、候选验证、结构化输出、独立记录验证和目标中立报告1。审计结果分为三类：已确认、需验证和已驳回1。工具具有对抗性验证、多次运行可改进覆盖率和源代码溯源等关键特性1。

使用该技能需要支持工具使用和并行子代理的编码代理、Node.js以及OS强制沙箱隔离1。用户可通过执行命令npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit进行安装1。该项目采用MIT许可证1。

Cloudflare has released Security-Audit-Skill, an open-source AI coding agent capability designed to transform agents into automated security auditing tools.1 The skill implements a structured six-stage audit workflow to identify code vulnerabilities: reconnaissance, coverage-driven hunting, candidate validation, structured output generation, independent record verification, and neutral target reporting.1

The tool classifies findings into three categories: confirmed, needs_validation, and rejected.1 Security-Audit-Skill represents an open-source iteration of Cloudflare's internal vulnerability discovery system.1 To use the skill, developers can install it via the command npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit.1 The project is distributed under the MIT license.1

The implementation requires coding agents that support tool use and parallel sub-agents, along with Node.js and operating system-level sandbox isolation.1 Key features include adversarial validation mechanisms, improved coverage through multiple runs, and source code traceability.1