Cloudflare's security-audit skill rejected my output 7 times

Описание и применение

Скилл Cloudflare security‑audit отклонил вывод автора семь раз из‑за строгой схемы JSON, требующей точного соблюдения полей и типов. После исправлений валидатор принял три единицы покрытия и три уязвимости.

Задача

The Cloudflare security-audit skill rejected the author’s audit output seven times before accepting it, revealing strict validation rules that can hinder quick adoption.

Результат

The audit skill’s validators enforce a detailed JSON schema, rejecting outputs that miss required fields, use incorrect types, or fail to derive identifiers. The author’s seven rejections highlighted the need for precise adherence to the schema.

Рабочий процесс

• Install the skill with npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit
• Create a two‑file repo and plant three vulnerabilities
• Run the audit with the quick profile (restricted path)
• Iteratively adjust coverage-ledger.json and findings.json to satisfy validator errors
• Re‑run until the validator reports PASS for all units and findings

Доказательства

The validators rejected my output seven times before anything counted.

Источник

Phase 1 writes coverage-ledger.json. My first version was an object wrapping an array, because that is how I would design it. The validator disagreed immediately: ERROR: $: expected a top-level array

Источник

Fourth version: PASS: 3 coverage units valid

Источник

Version five passed: PASS: 3 findings valid

Источник