Cloudflare 团队把其内部找漏洞的那套方法做成了一个 Skill，叫 security-audit，并开源了。
This is a AI post classified by Jev as MCP & agent skills (a tool drop), kept by the AI Radar because it carries real work, not commentary.
Cloudflare 团队把其内部找漏洞的那套方法做成了一个 Skill，叫 security-audit，并开源了。 装进编码 Agent 就能对自己的代码库跑一次正经的安全审计，已斩获 11000+ Star！ 流程分 6 个阶段，先摸清架构和信任边界，再派出多个独立的 Agent 分片去找，每个候选漏洞交给一个新的 Agent 专门去推翻它。 GitHub：http://github.com/cloudflare/security-audit-skill 它的规矩是找到的那个 Agent 不能自己验，验证阶段的目标就是证明这条不成立，最后只有三种结论，确认、待核实、已排除。 待核实的会写清卡在哪个具体事实上，不给严重程度。少了一层防护但另一层挡得住的，只算加固建议，不算漏洞。 产出是一份主报告加一份逐条细节，每条确认的都能追溯到源码位置。 Cloudflare 博客说这就是他们内部漏洞发现系统的起点，多跑几次结果会叠加，他们自己测下来单跑一次大概只能找到一半。 用法就一句「security audit this codebase」，在自己有权限审的代码库上跑，把结果当一份第二意见看，我觉得比裸问 Agent 靠谱得多。
Posted by GitHubDaily (84.6k followers) 8 h ago · 70 likes · 5.2k views · view the original post on X. Kept by the AI Radar as MCP & agent skills. Tools mentioned: security-audit-skill.
More AI work like this
- Working on a new Hermes plugin. first rev. Lotta of work to go bug PRs, request PRs… — @MichaelGannotti
- It’s here. — @unusual_whales
- 用 GPT 做了个可以基于你的代码库生成产品更新宣传片的 skill（guizang-product-video-skill） — @op7418
- We just launched the @LetMeSendEmail MCP server 🚀 — @_gchauhan
- It’s here. — @unusual_whales
- Adds small, composable skills to agents for opening apps, browsing the web, and creating… — @tom_doerr
- Inspo turns design research into an agent skill. — @davidarngar
- 💡 Safari 27 - new MCP server — @sebastienlorber
Every post is read and classified by Jev (TypeSafe): what it is, which market it belongs to, and whether the link is a real tool. 27.2k posts from 4.8k X accounts over the last 14 days, 1.2k tools, 19 markets. Collected every 5 minutes, fully re-ranked every hour — last update 2026-09-19 18:08 UTC. Full method.