Audit repositories, CI/CD pipelines, and dependency supply chains for security issues.
npx skills add https://github.com/24601/gastack-pre-fork --skill cso-24601
Please help me install this Agent Skill. Skill: cso Source: https://github.com/24601/gastack-pre-fork/tree/main/cso Command: npx skills add https://github.com/24601/gastack-pre-fork --skill cso-24601
Detects the real security risks a repository exposes beyond unit tests and quick scans: leaked secrets, CI/CD misconfigurations, dependency supply chain issues, insecure infrastructure, and unsafe AI/skill integrations. It turns noisy checklists into prioritized, actionable findings so teams can fix what attackers actually exploit.
Run the cso skill to perform a daily infrastructure-first audit of the current repository and generate a prioritized Security Posture Report.
High-intent search queries and answers about installing and using this skill.
A repository security audit detects leaked secrets in git history, CI/CD misconfigurations, vulnerable dependencies, and unsafe AI skill integrations. It maps the attack surface by inventorying endpoints, workflows, IaC, and external integrations to identify what attackers can actually exploit.
Secrets archaeology scans git history to find leaked keys, tracked .env files, and dangerous commits using high-confidence rules. This process exposes hardcoded credentials and sensitive environment configurations that attackers could exploit if left unresolved in the repository.
This security audit detects unpinned GitHub Actions, pull_request_target risks, privileged containers, and overly permissive IAM roles. By performing these CI/CD and infrastructure checks, it identifies pipeline misconfigurations that could allow unauthorized access or malicious code execution.
Dependency and supply chain analysis surfaces vulnerable or malicious packages, missing lockfiles, and risky install-time scripts in production dependencies. This audit identifies compromised external libraries that could introduce vulnerabilities or unauthorized code execution paths into your repository infrastructure.
alexander-danilenkoAutomate CI/CD pipelines, Dockerfiles, Kubernetes manifests, and Terraform modules.
CarbeneAIAudit codebases for leaked secrets, CI/CD misconfigurations, and vulnerable dependencies.
AradotsoHarden npm, pnpm, and Bun installs against supply-chain attacks.
icartshAnalyze .NET solutions for code quality, security, and dependency issues.
