Audits repositories for secrets, supply chain, CI/CD, LLM, and OWASP vulnerabilities.
npx skills add https://github.com/aicodepro/ai-agent-nexi --skill cso-aicodepro
Please help me install this Agent Skill. Skill: cso Source: https://github.com/aicodepro/ai-agent-nexi/tree/main/agent/skills/gstack/cso Command: npx skills add https://github.com/aicodepro/ai-agent-nexi --skill cso-aicodepro
High-intent search queries and answers about installing and using this skill.
Invoke the skill with a phrase like "security audit" or "CSO review". It runs stack detection first, then executes the audit phases matching your selected mode, and reports only findings that pass the confidence gate.
Daily mode reports only findings at 8/10 confidence or higher for zero-noise signal. Comprehensive mode is a monthly deep scan with a 2/10 reporting bar, covering all phases including OWASP Top 10 and STRIDE threat modeling.
Yes. Phase 2 performs secrets archaeology by searching git history for known credential prefixes like AKIA, ghp_, sk-, and xoxb-, checks for tracked .env files, and flags CI configs with inline secrets instead of secret stores.
Yes. Phase 7 checks for prompt injection vectors, unsanitized LLM output rendered as HTML, tool calling without validation, hardcoded AI API keys, and eval of LLM output, with severity ratings and false-positive rules.
No. Webhook verification is code-tracing only. The audit traces handler code and middleware chains to confirm signature verification exists, and never sends actual HTTP requests to endpoints.
jeffabaileyEvaluate repository development process maturity across documentation, workflow, and code review.
nexus-substrateTriage CodeQL and secret scanning alerts, fix findings, and classify secrets.
oioio-spaceAnalyze Go code for security vulnerabilities using gosec and govulncheck.
wojonsSimulate attacker methodologies to identify security vulnerabilities and penetration vectors across reconnaissance, exploitation, and assessment phases.
