Building Your Own Vulnerability Detection Harness

Security analysis that relies on a single model inevitably has limited coverage due to the model's inherent logical biases. Therefore, a model-agnostic architecture is needed that treats models as replaceable components and uses different models for the detection and validation stages.

Effective security analysis requires more than simple prompt engineering—an orchestration layer with state control, deduplication, resumability, and dependency tracking is essential. This is a fundamentally different problem from simply using subagents, and it is the core of building a continuous scanning pipeline for large-scale enterprise environments.

This system is designed around the following 7-stage Security Audit skill.

• Recon: Multiple research agents analyze the architecture
• Hunt: Hunter agents run attempts to break the code by attack class
• Validate: An Adversarial Validator runs to prove that discovered vulnerabilities are not errors
• Report: Verified findings are written up into a human-readable report
• Mechanical Check: Verify that the findings.json file conforms to the schema
• Independent Validation: A new agent re-verifies the findings against the source code
• Ingest: The final verified results are submitted via API