Audit infrastructure security across secrets, dependencies, CI/CD, and LLM integrations.
npx skills add https://github.com/a29paul/hexlens --skill cso-a29paul
Please help me install this Agent Skill. Skill: cso Source: https://github.com/a29paul/hexlens/tree/main/.claude/skills/gstack/cso Command: npx skills add https://github.com/a29paul/hexlens --skill cso-a29paul
Security audits often miss critical infrastructure vulnerabilities like exposed secrets in CI logs, stale API keys, and vulnerable dependencies. This skill provides an infrastructure-first security audit that covers the full attack surface, from secrets archaeology to OWASP Top 10 and STRIDE threat modeling.
Use the cso skill to run a full security audit on your project, covering infrastructure, dependencies, and application code.
High-intent search queries and answers about installing and using this skill.
To run an infrastructure security audit, use this skill to scan for vulnerabilities across CI/CD pipelines, dependency supply chains, secrets, and application code. It prioritizes real-world attack vectors over basic code-level checklist scanning.
STRIDE threat modeling and OWASP Top 10 coverage are security frameworks applied during the audit to identify vulnerabilities across application code and infrastructure. This skill actively integrates both methodologies to ensure comprehensive threat assessment.
Yes, you can configure confidence gates for dependency scanning. The skill supports dual audit modes: a daily zero-noise audit with an 8/10 confidence gate, or a comprehensive monthly deep scan with a 2/10 bar for thorough coverage.
Yes, this security audit checks for exposed secrets in CI logs and stale API keys. It performs secrets archaeology to uncover hidden credentials across your infrastructure, ensuring comprehensive secrets detection.
The best way to prepare for penetration testing is to run a comprehensive monthly deep scan with a low confidence gate. This infrastructure-first audit identifies potential vulnerabilities across your entire stack before active verification.
LLM integration security is assessed as part of the infrastructure-first audit approach. The skill scans LLM and AI integrations for vulnerabilities alongside application code, CI/CD pipelines, and dependency supply chains to cover the full attack surface.
florianbuetowDetects integrity vulnerabilities in code, CI/CD configs, and dependencies.
ElbertePlinioGenerate STRIDE-based threat models for software repositories.
cegit27Audit infrastructure security across secrets, dependencies, CI/CD, and LLM/AI.
BishopCodesAutomate web application security assessments with OWASP testing and browser automation.
