Cloudflare just open-sourced an interesting approach to AI-assisted security audits: security-audit-skill.
Instead of asking one coding agent to “find vulnerabilities” and trusting its output, the skill uses a structured, multi-phase workflow:
→ Maps the architecture, trust boundaries, and attack surfaces → Assigns isolated agents to investigate different areas → Uses fresh agents to challenge and verify potential findings → Separates confirmed, unresolved, and rejected findings → Produces machine-readable results and detailed reports → Builds on previous runs to improve coverage over time
Garry Tan just open-sourced gstack, a collection of 23 opinionated tools that gives Claude Code specialized roles, including CEO, designer, engineering manager, staff engineer, QA, release manager, and documentation engineer.
The interesting part isn’t just the number of tools. It’s the workflow connecting them:
Think → Plan → Build → Review → Test → Ship → Reflect
Each step feeds context into the next. Product discovery produces design documents, engineering planning creates test plans, reviews look for problems that pass CI but could fail in production, and QA verifies fixes before shipping.
Some of the commands include:
→ /office-hours to challenge assumptions before writing code → /plan-ceo-review to rethink product scope and opportunities → /review to identify bugs and incomplete implementations → /qa to test, fix, verify, and generate regression tests → /ship to run final checks, push the changes, and open a PR → /design-shotgun to generate and compare multiple design directions
It's a prompt skill that stops your coding assistant from burying the actual answer under filler. Ten rules, all enforced: lead with the next action, number the steps, cap lists at five items, no "hope this helps," no recap, no preamble.
