Skill map Impeccable map pstack map Matt Pocock map Security audit map GitHub

security-audit map

commit c1c8a8c (2026-09-14)

Cloudflare's security-audit skill, step by step: recon, coverage-led hunting, adversarial validation, schema-checked findings, fresh-eyes verification, then reports.

ReconnaissancePhase 1Category: Set up the run. Tap for details.Set up the runrun-metadata.jsonrun-metadata.jsonparent writes run factsSTARTbudget-gatebudget-gatecan the budget pay?Category: Map the target (4 agents). Tap for details.Map the target (4 agents)agent-1a-stackagent-1a-stackproduct, stack, buildagent-1b-trustagent-1b-trustprincipals and controlsagent-1c-inputsagent-1c-inputsentry points to sinksagent-1d-sandboxagent-1d-sandboxwhat can run locallyCategory: Plan the coverage. Tap for details.Plan the coverageprior-runsprior-runsreuse past ledgersSTARTarchitecture.mdarchitecture.mdone-page map of thetargetcoverage-ledger.jsoncoverage-ledger.jsonthe list of work unitsvalidate-coverage-ledgervalidate-coverage-ledgernode script, no depsHuntingPhase 2Category: Assign the work. Tap for details.Assign the workrank-unitsrank-unitswho gets hunted firstSTARThunter-prompthunter-prompt9 parts, fixed orderCategory: Hunt. Tap for details.Hunthunterhuntergeneral agent, one unitsetSTARThunter-resulthunter-resultone JSON objectCategory: Find the gaps. Tap for details.Find the gapspost-wave-criticpost-wave-criticwhat did the wave miss?STARTfinal-clean-criticfinal-clean-criticthe second clean passValidationPhase 3Category: Try to disprove it. Tap for details.Try to disprove itconsolidateconsolidateone candidate per rootcauseSTARTcandidate-verifiercandidate-verifiertries to refute itverdict-rulesverdict-rulesconfirm, park or rejectStructured outputPhase 4Category: Write and validate. Tap for details.Write and validatefindings.jsonfindings.jsonevery final recordSTARTvalidate-findingsvalidate-findingsschema + semanticchecksCategory: Three verdicts. Tap for details.Three verdictsconfirmed-recordconfirmed-recordproven, with severityneeds_validationneeds_validationblocked lead, noseverityrejected-recordrejected-recorddisproved, kept on fileVerificationPhase 5Category: Re-check the records. Tap for details.Re-check the recordsrecord-verifierrecord-verifierfresh eyes on eachrecordSTARTfresh-re-verifierfresh-re-verifierchecks a bigreplacementCategory: Finish line. Tap for details.Finish linerun-statusrun-statuscomplete or incompleteSTARTReportingPhase 6Category: Write the reports. Tap for details.Write the reportsREPORT.mdREPORT.mdthe main write-upFINDINGS-DETAIL.mdFINDINGS-DETAIL.mdmedium and up, in fullNEEDS-VALIDATION.mdNEEDS-VALIDATION.mdleads for the ownerEvery phaseGroup: Pick the modePick the modeguidance-modeguidance-modedefault: answer, nofilesfull-audit-modefull-audit-modeall six phases + filesGroup: Run sizeRun sizequick-profilequick-profilesmall or fast firstlookstandard-profilestandard-profilethe defaultdeep-profiledeep-profilehigh stakes or largescoped-runscoped-runpaths, subsystem ordiffGroup: Safety railsSafety railsos-sandboxos-sandboxwhere target code mayrunwrite-isolationwrite-isolationone writer per fileartifact-promotionartifact-promotionscratch → artifacts,safelycost-budgetcost-budgetspend in a fixed orderGroup: Proof and severity rulesProof and severity rulesboundary-and-resultboundary-and-resultno boundary, no findingseverity-anchorsseverity-anchorscritical toinformationalsmallest-fixsmallest-fixfix at the last trustedcheckanti-patternsanti-patterns10 things it refusesGroup: Attack classes: coreAttack classes: coreinjectioninjectionuntrusted input to asinkaccess-controlaccess-controlright check, rightresourceresource-and-fileresource-and-filetraversal, SSRF,archivescrypto-and-secretscrypto-and-secretskeys, randomness,timingbusiness-logicbusiness-logichunted by handGroup: Attack classes: wider netAttack classes: wider netfeature-abusefeature-abusefeatures used asweaponschained-trustchained-trustsafe parts, unsafewholewildcardwildcardno category on purposeobvious-thingsobvious-thingsthe basics nobodychecksGroup: Companions: code and protocolsCompanions: code and protocolsMEMORY-SAFETY-AND-BINARY.mdMEMORY-SAFETY-AND-BINARY.mdnative, parsers,kernelsWEB-PROTOCOL-AND-AUTH.mdWEB-PROTOCOL-AND-AUTH.mdHTTP, sessions,identityCLIENT-SIDE.mdCLIENT-SIDE.mdbrowser trust decisionsPROTOCOLS-RPC-AND-MESSAGING.mdPROTOCOLS-RPC-AND-MESSAGING.mdRPC, queues, webhooksAI-AND-LLM.mdAI-AND-LLM.mdmodels with authorityGroup: Companions: platform and dataCompanions: platform and dataSUPPLY-CHAIN-AND-RELEASE.mdSUPPLY-CHAIN-AND-RELEASE.mddeps, CI, releaseCLOUD-AND-DEPLOYMENT.mdCLOUD-AND-DEPLOYMENT.mdIAM, IaC, containersRESOURCE-EXHAUSTION-AND-AVAILABILITY.mdRESOURCE-EXHAUSTION-AND-AVAILABILITY.mdshared CPU, queues,spendDATA-ISOLATION-AND-LIFECYCLE.mdDATA-ISOLATION-AND-LIFECYCLE.mdtenants, copies,deletionDESKTOP-MOBILE-AND-LOCAL-IPC.mdDESKTOP-MOBILE-AND-LOCAL-IPC.mdapps, deep links, IPC

Best-practice order

1ReconnaissanceMap the target from source only, then turn it
2HuntingIsolated hunters work from the ledger, unit by
3ValidationEvery unique candidate goes to a fresh verifie
4Structured outputAll final records go into findings.json, check
5VerificationFresh agents re-check the final records themse
6ReportingReports are derived from the verified records