skills.rest
VertaKhan
VertaKhanCOMMUNITY
Explore all skills by this author →
GitHub

cso

Audits codebases and infrastructure for security vulnerabilities and produces a posture report.

Updated Apr 5, 2026
Search Tags:#code review#OWASP#threat modeling#security audit#ci/cd security#supply chain#secrets scanning
One-click install
npx skills add https://github.com/VertaKhan/cs_gstack --skill cso-vertakhan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cso
Source: https://github.com/VertaKhan/cs_gstack/tree/main/.claude/skills/gstack/cso
Command: npx skills add https://github.com/VertaKhan/cs_gstack --skill cso-vertakhan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security reviews often focus only on application code while missing the real attack surface: leaked secrets in git history, vulnerable dependencies, misconfigured CI/CD pipelines, and shadow infrastructure. This Skill runs a structured, multi-phase security audit that covers both code and infrastructure, then reports findings with severity ratings and remediation plans. ## Core Features & Use Cases - Infrastructure-first audit phases: secrets archaeology in git history, dependency supply chain analysis, CI/CD pipeline security, webhook and integration review, and skill supply chain scanning. - Code-level analysis: OWASP Top 10 checks, STRIDE threat modeling, LLM/AI-specific security checks, and active verification of findings. - Two confidence modes: daily mode with an 8/10 confidence gate for zero-noise reporting, and comprehensive mode with a 2/10 bar for monthly deep scans, plus trend tracking across runs. - Use Case: Before shipping a release, run a full audit to catch an unpinned GitHub Action, a Stripe key committed six months ago, and a Dockerfile running as root, all in one Security Posture Report. ## Quick Start Ask the AI to run a security audit of this repository with /cso and report only high-confidence findings with remediation steps.

Frequently Asked Questions about cso

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on my codebase with AI?▼

Invoke /cso with no flags to run all audit phases in daily mode, which reports only findings above an 8/10 confidence threshold. The audit covers secrets in git history, dependencies, CI/CD pipelines, infrastructure configs, and OWASP Top 10 code issues.

What does a CI/CD pipeline security audit check?▼

The audit checks GitHub Actions workflows for unpinned third-party actions, dangerous pull_request_target triggers, script injection via github.event context in run steps, secrets exposed as env vars, and missing CODEOWNERS protection on workflow files.

Can I audit only the changes on my current branch?▼

Yes, the --diff flag constrains every phase to files and configs changed on the current branch versus the base branch. It is combinable with any scope flag and with --comprehensive mode.

Does the security audit work with Python and Go projects?▼

Yes, Phase 0 detects stacks including Node/TypeScript, Python, Go, Ruby, Rust, JVM, PHP, and .NET, plus frameworks like Django, FastAPI, Rails, and Gin. Detection sets scan priority, but a catch-all pass still covers undetected languages.

What is the difference between daily and comprehensive audit modes?▼

Daily mode applies an 8/10 confidence gate so only high-confidence findings are reported, minimizing noise. Comprehensive mode lowers the bar to 2/10, surfacing more potential issues for monthly deep reviews.

Does the audit make code changes to fix vulnerabilities?▼

No, the audit never modifies code. It produces a Security Posture Report containing concrete findings, severity ratings from CRITICAL to MEDIUM, and remediation plans for the user to act on.

Related Skills

Explore More Software Engineering Skills→
jeffabaileyjeffabailey
3

review-process

Evaluate repository development process maturity across documentation, workflow, and code review.

Community
Advanced
nexus-substratenexus-substrate
18

security-scanning

Triage CodeQL and secret scanning alerts, fix findings, and classify secrets.

Official
Advanced
mykaarmamykaarma

vuln-scan

Scan dependencies, containers, Kubernetes manifests, and secrets for critical vulnerabilities.

Official
Advanced
bianhaifeng789-huebianhaifeng789-hue

vulnerable-secret

Extracts secrets from vulnerable ELF binaries using static and dynamic analysis techniques.

Community
Intermediate