#audit

Advanced developer tutorial: Agent logs can be altered, so what can you use to prove integrity during an audit? Use signed receipts to record each tool call, hash chains to prevent deletion and tampering, and clarify what they can and cannot prove.

Use when a user wants a security audit of their own codebase, vulnerability hunting, penetration-style review, or analysis of security issues in a specific piece of code. Based on Cloudflare's open-source security-audit-skill (MIT): reconnaissance, parallel vulnerability hunting, one-by-one attempts to refute each finding, independent review, and report generation. Reads source code only, does not touch production, does not run target code without a sandbox, and speculation does not count as a vulnerability. Use case: Have an Agent run a structured security audit of your own codebase, where every suspicion is verified by another Agent, producing a report with evidence.