Cloudflare's security-audit skill rejected my output 7 times

说明与用途

Cloudflare 的 security‑audit 技能因严格的 JSON 模式而拒绝了作者的输出七次。修正后，验证器接受了三条覆盖单元和三条发现。

问题

The Cloudflare security-audit skill rejected the author’s audit output seven times before accepting it, revealing strict validation rules that can hinder quick adoption.

结果

The audit skill’s validators enforce a detailed JSON schema, rejecting outputs that miss required fields, use incorrect types, or fail to derive identifiers. The author’s seven rejections highlighted the need for precise adherence to the schema.

工作流

• Install the skill with npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit
• Create a two‑file repo and plant three vulnerabilities
• Run the audit with the quick profile (restricted path)
• Iteratively adjust coverage-ledger.json and findings.json to satisfy validator errors
• Re‑run until the validator reports PASS for all units and findings

证据

The validators rejected my output seven times before anything counted.

来源

Phase 1 writes coverage-ledger.json. My first version was an object wrapping an array, because that is how I would design it. The validator disagreed immediately: ERROR: $: expected a top-level array

来源

Fourth version: PASS: 3 coverage units valid

来源

Version five passed: PASS: 3 findings valid

来源