cso

Invoke the audit with a phrase like "security audit" or "OWASP review". The skill detects your stack, maps the attack surface, then runs phased checks across secrets, dependencies, CI/CD, and application code, reporting only confidence-scored findings.

Daily mode applies a strict 8/10 confidence gate so only near-certain findings are reported, keeping noise at zero. Comprehensive mode is a monthly deep scan with a 2/10 reporting bar that surfaces lower-confidence leads for manual review.

Yes. Phase 2 runs secrets archaeology using git log searches for known credential prefixes like AKIA, ghp_, sk-, and xoxb-, checks whether .env files are tracked, and flags CI configs with inline secrets instead of secret stores.

Yes. Phase 7 checks for prompt injection vectors, unsanitized LLM output rendered as HTML, tool calling without validation, hardcoded AI API keys, and eval of LLM output, with false-positive rules for normal user-message content.

Each phase carries explicit false-positive rules, such as excluding placeholders and test fixtures for secrets, and requiring evidence that no upstream gateway handles webhook signature verification. Findings are verified by tracing data flow before reporting.

The audit uses code tracing only and makes no live requests, so it cannot confirm runtime exploitability like an active pentest would. Missing optional tools such as package-manager audit CLIs are reported as skipped rather than run.