A new open tool called security-audit-skill, built as a skill for Cloudflare's coding agent, runs a six-phase security audit on a code repository and uses a separate AI agent to challenge each vulnerability finding before it is reported.
Open tool · security-audit-skill
A skeptic agent challenges every finding before it reaches a reviewer
Built as a skill for Cloudflare's coding agent, security-audit-skill runs a six-phase audit on a code repository. One agent maps the code and searches for bugs; a separate agent tries to disprove each finding. Only findings that survive are reported, labeled by classification.
6
audit phases in the workflow
2
separate agent roles: discover and challenge
0
independent benchmarks or accuracy figures published so far
How a finding gets reported
Each stage filters the output before a human sees it.
Step 1
Discover
Agent maps the codebase structure and searches for bugs.
→
Step 2
Challenge
A different agent tries to disprove each finding.
→
Step 3
Report
Only surviving findings are shown, each with a classification label.
The six-phase audit
Six phases are confirmed. The announcement does not break down what each one covers.
Phase 1
Phase 2
Phase 3
Phase 4
Phase 5
Phase 6
Why the design matters
Automated scanners often produce many false positives, which waste developer time and erode trust.
A skeptic agent applies adversarial verification, a pattern where a second model checks a first model's output.
If the verification step holds up, multi-agent review pipelines could become a standard part of development.
Open questions
Real-world detection and false-positive rates are unverified.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article...