tl;dr: Cloudflare open-sourced a "skill" for coding agents that runs a structured six-phase security audit: reconnaissance, coverage-led hunting, adversarial validation by separate agents, schema-validated findings output, independent verification, and target-neutral reporting. It enforces principles like separating hunters from validators, requiring source-grounded confirmation, and treating defense-in-depth gaps as hardening notes rather than vulnerabilities. This is the single-repo precursor to Cloudflare's internal vulnerability discovery harness, installable via the Skills CLI and requiring Node.js plus a sandboxed environment for executing target code.