Cloudflare Security Audit Skill
Star of the week, issue #13What it is
The MIT-licensed skill behind Cloudflare's internal fleet-wide vulnerability harness, installable into Claude Code or any skills-compatible agent with one `npx skills add`. It structures an audit as six phases — reconnaissance, coverage-led hunting by isolated hunter agents, adversarial validation by fresh verifier agents that never saw the hunt, schema-validated findings, independent re-verification, and a target-neutral report. Cloudflare's own funnel numbers: 20,799 raw candidates filtered to 12,057 validated and 7,245 findings engineering teams actually acted on.
Visit Cloudflare Security Audit Skill →
Featured in
Issue #13 — Incident Report · — the full issue has that week's other tools, reads, and big-lab releases.
More agents tools we've covered
- AX Google's open orchestration runtime for agent workloads, in the Kubernetes idiom: you declare a Task and a Workspace in YAML — the git repos, MCP servers, and skills an agent needs — and AX runs it in a sandbox with CPU and memory limits, suspends it while it waits on a model, and resumes it in under a second. The part that matters this week is the Gateway: outbound traffic locked to an explicit allowlist of hosts and ports, with credentials injected at the edge rather than handed to the agent. Apache-2.0, written in Go.
- OpenExecutive An open-source virtual executive team: one coherent executive persona backed by eight specialist Claude agents — strategy, finance, HR, legal, operations, marketing, product, and board communications — with episodic memory in SQLite, a ChromaDB vector store, and interfaces for web, Slack, email, Telegram, Discord, and the CLI. Apache 2.0, FastAPI plus Next.js; clone it, add an `ANTHROPIC_API_KEY`, and `make dev` puts the corner office on localhost:3000.
- DeepSeek Harness (dsh) DeepSeek's own agent harness, MIT, built on Cordis and organised so that everything — including the desktop and the Web UI — is a plugin. `npx @deepseek-ai/dsh web` starts a local server on 127.0.0.1:3080 and opens it; the README labels the whole thing a developer preview and warns in capitals that compatibility-breaking changes are coming.
- Agent Governance Toolkit Microsoft's policy enforcement, agent identity, sandboxing, and audit layer for autonomous agents — one pip install, any framework. It intercepts tool calls and delegations before execution with deterministic fail-closed controls, and claims coverage of all ten OWASP Agentic risks. Python, TypeScript/.NET, Rust, and Go.