DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to check audit records against the schema and ledger rules with Security Audit Skill

Run the bundled validators on findings and coverage files before you share results.

Authorization notice. Security Audit Skill is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Who it is forA security team lead or CI owner who receives audit output from an agent and must confirm it meets the expected structure.

The problemStructured audit output can be malformed or incomplete, and reports built on it are unreliable.

The outcomeConfirmation that findings.json matches report-schema.json and coverage-ledger.json passes its validator, so the records are safe to share.

What you need first

  • A coding agent with a model that supports tool use and parallel sub-agents
  • Node.js, for the zero-dependency findings and coverage-ledger validators
  • An OS-enforced sandbox if the audit must run target-controlled builds, tests, or fixtures; without it, the workflow keeps leads as needs_validation instead of executing target code
  • The skill installed with the Skills CLI (npx skills add)

Steps

  1. Clone or download the repository at github.com/cloudflare/security-audit-skill.
  2. Run node validate-findings.cjs against your findings.json, following the script's usage message. (inferred, check the README)
  3. Run node validate-coverage-ledger.cjs against your coverage-ledger.json. (inferred, check the README)
  4. Fix any reported errors and rerun both validators until they pass.
  5. Share only the validated records with reviewers.

Prompt for your agent

Using the validators in github.com/cloudflare/security-audit-skill, check <output-dir>/findings.json against report-schema.json and <output-dir>/coverage-ledger.json. Report any validation errors. Verify that the validators exit cleanly before the records are shared.

Caveat. The README names the validator files but does not show their command-line usage, so confirm the invocation from each script before relying on it.

Share: X LinkedIn Hacker News Email Copy link

Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer