Turn your coding agent into a security auditor with a multi-phase, independently verified vulnerability discovery system.
A comprehensive approach to security auditing with independent verification and machine-readable findings
Map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage in architecture.md and coverage-ledger.json
Assign isolated hunters from ledger units, record their checks, and use coverage critics to find gaps in security coverage
Give every unique candidate to a fresh verifier that tries to disprove it through adversarial validation
Write confirmed, needs_validation, and rejected records to findings.json and validate them against report-schema.json
Fresh agents verify final source claims. Material replacements receive another independent verifier
Generate REPORT.md, FINDINGS-DETAIL.md, and NEEDS-VALIDATION.md from verified records and coverage ledger
Add the security audit skill to your coding agent with a single command. Works with any agent that supports tool use and parallel sub-agents.
Built on security-first principles for reliable vulnerability discovery
Only confirm established boundary failures. Keep source-grounded blocked leads as needs_validation with exact unresolved facts.
The agent that checks a finding is never the agent that found it, ensuring unbiased verification of security issues.
Severity requires impact. Likelihood × impact, not deviation from a checklist, for meaningful risk assessment.
Defense-in-depth gaps are not vulnerabilities. If Layer A prevents the attack, the absence of Layer B is a hardening note.
Multiple runs improve coverage. In test runs, repeated runs found twice as many vulnerabilities as single runs.
Machine-readable findings with JSON schema validation for integration with security toolchains and workflows.