Overview
Cloudflare's `security-audit` skill turns an AI-assisted security review from a list of suspicious patterns into a traceable chain of evidence. The series moves from authorization and boundary mapping to stable coverage units, invariant-driven hunting, domain-specific reasoning, independent candidate validation, branch-specific records, and target-neutral reporting. It shows how to distinguish confirmed impact from rejected claims and source-grounded needs-validation leads when deployment, provider, browser, OS, broker, or identity facts remain outside the repository. The workflow supports bounded local checks in a sandbox and makes scope, budget, deferred work, and uncertainty visible; it does not promise exhaustive detection or authorize live, shared, or production testing.
Learning outcomes
- A security claim needs a named principal, protected resource, intended control, source path, and observable result.
- Coverage is inspectable only when boundaries become stable units with owners, evidence, and explicit states.
- Independent validation and final verification prevent plausible traces from becoming stronger than their evidence.
- The workflow preserves uncertainty when deployment facts or safe local observation are unavailable; it does not promise completeness.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
What does Cloudflare's security-audit skill actually establish?
It establishes bounded, traceable security claims when source evidence, safe local results, and independent checks support them; it does not promise exhaustive detection.
How does the workflow decide whether a finding is confirmed?
A finding is confirmed only when a complete source trace, relevant conditions, a bounded target-native result, remediation, and independent verification show meaningful boundary impact.
What happens when a security claim depends on deployment behavior?
It remains needs-validation when a source-grounded path depends on an unavailable proxy, provider, browser, OS, broker, or identity fact, with an exact blocker and safe observation plan.
Why does the security-audit skill use a coverage ledger?
It turns mapped boundary combinations into stable, owned units with paths, checks, candidates, blockers, and status, so coverage is inspectable rather than inferred from activity.