Cloudflare's security-audit skill rejected my output 7 times

Description and use

The Cloudflare security‑audit skill rejected the author’s output seven times due to strict JSON schema enforcement. After correcting the schema, the validator accepted three coverage units and three findings.

Problem

The Cloudflare security-audit skill rejected the author’s audit output seven times before accepting it, revealing strict validation rules that can hinder quick adoption.

Outcome

The audit skill’s validators enforce a detailed JSON schema, rejecting outputs that miss required fields, use incorrect types, or fail to derive identifiers. The author’s seven rejections highlighted the need for precise adherence to the schema.

Workflow

• Install the skill with npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit
• Create a two‑file repo and plant three vulnerabilities
• Run the audit with the quick profile (restricted path)
• Iteratively adjust coverage-ledger.json and findings.json to satisfy validator errors
• Re‑run until the validator reports PASS for all units and findings

Evidence

The validators rejected my output seven times before anything counted.

Source

Phase 1 writes coverage-ledger.json. My first version was an object wrapping an array, because that is how I would design it. The validator disagreed immediately: ERROR: $: expected a top-level array

Source

Fourth version: PASS: 3 coverage units valid

Source

Version five passed: PASS: 3 findings valid

Source