Cloudflare Open-Sources Its Vulnerability Discovery Skill

Your coding agent can write code quickly, but can it tell you where that code is weak? Cloudflare just open-sourced the skill behind its own vulnerability discovery harness, and the way it checks its own findings is the part worth reading about.

The skill runs separate agents through three stages — recon, hunting, then verification — so a suspected hole gets a second look before it ever lands in your report.

What Happened

Cloudflare open-sourced the skill that seeded its vulnerability discovery harness. It works in stages: one set of agents does recon, another hunts for security holes, and a final pass verifies each finding before it is handed over.

Splitting the job across agents is the point: the agent looking for problems is not the agent deciding whether a problem is real.

The post does not name the repository and does not include a link, so there is nothing to download from it directly. If you want the code, you will have to find Cloudflare's release yourself.

Why It Matters

Automated scanning has a noise problem. A tool that flags everything costs you more time than it saves — and that gets worse when the tool is an AI agent that sounds confident about every guess.

Putting a verification step between the hunt and the report is a simple fix: a second agent has to agree before anything gets called a vulnerability. Whether that holds up on real code is the open question, but it is the right place to spend effort.