skills.rest
AkbarDevop
AkbarDevopCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

cso

Audit infrastructure security for leaked credentials, supply chain risks, and CI/CD issues.

Updated Mar 13, 2026
Search Tags:#security audit#dependency analysis#ci/cd security#supply chain security#infrastructure security
One-click install
npx skills add https://github.com/AkbarDevop/ayah-studio --skill cso-akbardevop
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cso
Source: https://github.com/AkbarDevop/ayah-studio/tree/main/.claude/skills/gstack/cso
Command: npx skills add https://github.com/AkbarDevop/ayah-studio --skill cso-akbardevop

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires Bash, Read, Grep, Glob, Write, Agent, WebSearch, AskUserQuestion, and includes scripts (resource) and references (resource) components.

What problem does it solve?

The cso Skill solves the problem of comprehensive security audits, focusing on infrastructure, secrets archaeology, dependency supply chain, and more, with an infrastructure-first approach.

Core Features & Use Cases

  • Security Audit: Performs a daily audit (8/10 confidence gate) and a monthly deep scan (2/10 bar).
  • Secrets Archaeology: Detects leaked credentials in git history and tracked configuration files.
  • Dependency Supply Chain: Checks for supply chain risks and known CVEs in direct dependencies.
  • CI/CD Pipeline Security: Analyzes GitHub Actions, GitLab CI, and CircleCI workflows for security risks.
  • Infrastructure Shadow Surface: Finds shadow infrastructure with excessive access, including Dockerfiles and Terraform configurations.
  • Webhook & Integration Audit: Identifies inbound endpoints that accept anything and checks for TLS verification and OAuth scopes.
  • LLM & AI Security: Checks for AI/LLM-specific vulnerabilities like prompt injection and unsanitized LLM output.

Quick Start

Run the cso skill with the command: /cso

Frequently Asked Questions about cso

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run an infrastructure-first security audit for my application?▼

An infrastructure-first security audit scans your project for leaked credentials, supply chain risks, and CI/CD pipeline issues. You can automate this by running a command that analyzes your git history, dependencies, and infrastructure configurations for vulnerabilities.

What is secrets archaeology in git history and how does it find leaked credentials?▼

Secrets archaeology is the process of detecting leaked credentials in tracked configuration files and git history. It works by scanning commits and file contents to identify exposed API keys, tokens, and passwords that may have been accidentally committed.

Can I check CI/CD pipeline security workflows in GitHub Actions and GitLab CI?▼

Yes, you can analyze CI/CD pipeline security for GitHub Actions, GitLab CI, and CircleCI workflows. The audit identifies security risks within your pipeline configurations, helping you detect misconfigurations and excessive access permissions.

How do I scan for supply chain risks and known CVEs in direct dependencies?▼

Scanning for supply chain risks involves checking your direct dependencies for known CVEs and malicious packages. This process evaluates your dependency tree against vulnerability databases to identify components that require immediate updating or replacement.

Does LLM security cover prompt injection and unsanitized output vulnerabilities?▼

LLM security checks specifically target prompt injection and unsanitized LLM output vulnerabilities. This ensures that AI integrations within your application do not allow unauthorized command execution or leak sensitive data through generated text.

What is the difference between a daily security audit and a monthly deep scan?▼

A daily security audit operates at an 8/10 confidence gate to catch high-probability issues quickly, while a monthly deep scan uses a 2/10 confidence bar to surface subtle, low-probability vulnerabilities across your infrastructure and codebase.

Related Skills

Explore More Software Engineering Skills→
iiammaeiiammae

differential-review

Automate security-focused code review of diffs and generate markdown reports.

Community
Advanced
carlheathcarlheath
9

Security Specialist

Assess software and infrastructure security vulnerabilities and threats.

Community
Advanced
harperaaharperaa
15

supply-chain-dependency-risks-ai-code

Analyze dependency manifests for CVEs, typosquatting, and dependency-confusion risks.

Community
Intermediate
matteocervellimatteocervelli
25

security-scanner

Scan codebases for secrets, vulnerable dependencies, and insecure patterns.

Community
Advanced