DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to re-audit a repo to cover only changed code with Security Audit Skill

Reuse prior ledgers and findings so a second audit targets gaps and changed source.

Authorization notice. Security Audit Skill is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Who it is forA security owner whose repository has changed since the last audit and who wants current coverage without starting from zero.

The problemRe-running an audit from scratch repeats work, while skipping it leaves new code unreviewed.

The outcomeAn updated findings and coverage set where changed source is revalidated and stale or unresolved work is not counted as covered.

What you need first

  • A coding agent with a model that supports tool use and parallel sub-agents
  • Node.js, for the zero-dependency findings and coverage-ledger validators
  • An OS-enforced sandbox if the audit must run target-controlled builds, tests, or fixtures; without it, the workflow keeps leads as needs_validation instead of executing target code
  • The skill installed with the Skills CLI (npx skills add)

Steps

  1. Keep the output directory from the earlier run, such as ~/audits/my-project.
  2. Start your coding agent in the repository after the changes are merged.
  3. Ask the agent: do a security review, output to ~/audits/my-project
  4. Check the new coverage-ledger.json for units marked as changed or unresolved.
  5. Compare the new findings.json with the earlier one to see what is new, confirmed again, or rejected.

Prompt for your agent

Using the security-audit skill from github.com/cloudflare/security-audit-skill, rerun the audit of <target-repo-path> into the existing <output-dir>. Report the count of confirmed, needs_validation, and rejected records. Verify that no unresolved unit is marked as covered in coverage-ledger.json.

Caveat. The README says repeated runs improve coverage, and a single run found about half of what repeated runs found in its tests, so one rerun is not a guarantee of completeness.

Share: X LinkedIn Hacker News Email Copy link

Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer