Hacker news

  • Top
  • New
  • Past
  • Ask
  • Show
  • Jobs

Cloudflare/Security-Audit-Skill (https://github.com)

210 points by donk8r 3 days ago | 38 comments | View on ycombinator

gbrindisi 3 days ago |

Shameless plug: in case someone finds this requiring too many tokens, we shared the recipe on how we built our own in house audit skill so that it can easily be replicated and tuned to different environments https://www.synthesia.io/post/automating-code-security-revie...

prodigycorp 3 days ago |

Hi Cloudflare people, if you are reading this. Please clean up your Cloudflare. Skills. There are way too many skills for the platform. You should consolidate all of your skills into a single skill and route everything thru that skill. The way it is right now pollutes our context window.

https://github.com/cloudflare/skills/tree/main/skills

wslh 3 days ago |

Tip for security professionals using LLMs: audit skills that explicitly frame the task as security research sometimes trigger refusals from the top OpenAI and Anthropic models because they guard against misuse. What works for me: separate skills for bug classes (and bugs in general) without the security framing, plus another skill that combines their findings to spot security bugs.

acedTrex 3 days ago |

Incredible, a post and repo dedicated to a markdown file, the downfall of this field has been swift.

drchaim 3 days ago |

I threw 1M tokens for nothing in a medium codebase.

hyperionultra 3 days ago |

Uf, how much tokens?

qsbuilder 3 days ago |

Dumping 14 full schemas into the prompt is just lazy design. You burn tokens, spike latency for no reason

tonymet 3 days ago |

What’s the difference between a skill and a prompt? Separate files? Aren’t tokens, tokens?

9el 3 days ago |

Any clues why "an OS-enforced sandbox" is in requirements?

aitoolcrux 3 days ago |

[flagged]