Thread

Cloudflare/Security-Audit-Skill

212 points · 38 comments · donk8r

Loading the complete thread in the background. This saved snapshot is available now. Refresh

hyperionultra · 1789624136 · focus · HN ↗
Uf, how much tokens?
1. jesse_dot_id · 1789628786 · focus · HN ↗
  At least 150k on my FastAPI project, but hit my session limit. Continuing in a few hours.
  1. chrisweekly · 1789647545 · focus · HN ↗
    Oof. YAGNI. 150k tokens is where you start hitting the "dumb zone" (model attention issues and inconsistent adherence to instructions).
drchaim · 1789628228 · focus · HN ↗
I threw 1M tokens for nothing in a medium codebase.
1. TZubiri · 1789629121 · focus · HN ↗
  how much is medium codebase, like 50kloc including docs?
  1. throwup238 · 1789635356 · focus · HN ↗
    500kloc plus at least ten million lines of gastown logs.
    For a todo cli. That doesn’t work.
    this_user · 1789638633 · focus · HN ↗
    Welcome to agentic coding in 2026.
  2. drchaim · 1789638884 · focus · HN ↗
    in this case medium is relative to the projects I've worked. Bad expression anyway.
2. TrustScoreAgent · 1789654347 · focus · HN ↗
  [dead]
3. SkyPuncher · 1789658006 · focus · HN ↗
  These work best on a targeted section of the code, like a PR.
prodigycorp · 1789631883 · focus · HN ↗
Hi Cloudflare people, if you are reading this. Please clean up your Cloudflare. Skills. There are way too many skills for the platform. You should consolidate all of your skills into a single skill and route everything thru that skill. The way it is right now pollutes our context window.
<a href="https://github.com/cloudflare/skills/tree/main/skills" rel="nofollow">https://github.com/cloudflare/skills/tree/main/skills
1. m00dy · 1789635568 · focus · HN ↗
  I'm sure they read here.
  1. dewey · 1789636454 · focus · HN ↗
    They actually do.
    m00dy · 1789655490 · focus · HN ↗
    yeah I know :D
  2. bravetraveler · 1789640517 · focus · HN ↗
    John Cloudflare: <a href="https://news.ycombinator.com/user?id=eastdakota">https://news.ycombinator.com/user?id=eastdakota
    [deleted] · 1789647711 · focus · HN ↗
    [deleted]
  3. kentonv · 1789654854 · focus · HN ↗
    We actually do.
    I forwarded this to the right person, and it sounds like it's being worked on. Thanks!
    tomrod · 1789657319 · focus · HN ↗
    Once again, proving my growing trust in Cloudflare is well placed. Thanks!
    prodigycorp · 1789704916 · focus · HN ↗
    I complain because I like using CF. Thank you.
  4. acoyfellow · 1789655402 · focus · HN ↗
    we do <3
2. mooktakim · 1789642765 · focus · HN ↗
  I really don't understand why they didn't create an "app store" style skills library where it could be approved and scanned for security issues
3. simlevesque · 1789649167 · focus · HN ↗
  14 skills with short descriptions doesn't seem like an issue to me.
  1. prodigycorp · 1789654430 · focus · HN ↗
    The descriptions are shorter now, but they used to read like ads. The skill split still feels arbitrary. You turn on what you think you need, then hit some Cloudflare task that needs another skill and have to go fetch it.
    I don’t get why these need to be separate. One skill with progressive disclosure already handles this. That’s kind of the point.
  2. riffic · 1789664077 · focus · HN ↗
    a skill issue.
9el · 1789636802 · focus · HN ↗
Any clues why "an OS-enforced sandbox" is in requirements?
1. nicce · 1789640954 · focus · HN ↗
  Probably to save their skin if agent starts to do some unexpected things and bringing havoc. But I doubt that OpenAI models with normal subscription, for example, wont even work with this skill.
2. donk8r · 1789664749 · focus · HN ↗
  Runs target builds, tests, fuzzers. No sandbox: workflow won't execute them. Lead stays needs_validation.
3. awss1i · 1789724306 · focus · HN ↗
  [dead]
gbrindisi · 1789637634 · focus · HN ↗
Shameless plug: in case someone finds this requiring too many tokens, we shared the recipe on how we built our own in house audit skill so that it can easily be replicated and tuned to different environments <a href="https://www.synthesia.io/post/automating-code-security-reviews-with-claude-mythos-level-capabilities" rel="nofollow">https://www.synthesia.io/post/automating-code-security-revie...
1. gyanchawdhary · 1789641913 · focus · HN ↗
  This is awesome. Thanks for sharing
wslh · 1789648828 · focus · HN ↗
Tip for security professionals using LLMs: audit skills that explicitly frame the task as security research sometimes trigger refusals from the top OpenAI and Anthropic models because they guard against misuse. What works for me: separate skills for bug classes (and bugs in general) without the security framing, plus another skill that combines their findings to spot security bugs.
1. viraptor · 1789651890 · focus · HN ↗
  If you're a security professional, go through their validation. You won't get the security refusals anymore. Well... you'll still get the occasional downgrade from Fable, but not the "oh no, I can't do exploits for you" breaks.
  1. xur17 · 1789657949 · focus · HN ↗
    Except their validation doesn't seem to work. I've gone through both (both personally and for my company), and.. no response for weeks.
    viraptor · 1789726810 · focus · HN ↗
    Weird. I have minimal publicly visible record of security work and got the approval almost immediately.
aitoolcrux · 1789653976 · focus · HN ↗
[dead]
tonymet · 1789657971 · focus · HN ↗
What’s the difference between a skill and a prompt? Separate files? Aren’t tokens, tokens?
1. fassssst · 1789659541 · focus · HN ↗
  Skills can have scripts packaged with them
acedTrex · 1789658554 · focus · HN ↗
Incredible, a post and repo dedicated to a markdown file, the downfall of this field has been swift.
1. vntok · 1789658767 · focus · HN ↗
  Did you open the repo? There's a subdirectory with two dozens of files, around 300Kb of text.
  Storing/visualizing small text changes over time as revisions is exactly what Git is excellent at, how else would you keep track of updates to the prompts?
  1. acedTrex · 1789660515 · focus · HN ↗
    > how else would you keep track of updates to the prompts
    I dont? because prompts are not a thing that are ever needed to be tracked lol.
2. decidu0us9034 · 1789665293 · focus · HN ↗
  but they're very huge markdown files. look how much junk they're polluting the conext window with.
qsbuilder · 1789661972 · focus · HN ↗
Dumping 14 full schemas into the prompt is just lazy design. You burn tokens, spike latency for no reason
beyondscale-yes · 1790573068 · focus · HN ↗
[dead]

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.