cso

What problem does it solve? Security reviews often miss the real attack surface: leaked credentials in git history, vulnerable dependencies, misconfigured CI/CD pipelines, and exposed infrastructure. This Skill runs a structured, multi-phase security audit that produces a concrete Security Posture Report with severity ratings and remediation plans, without making any code changes. ## Core Features & Use Cases - Secrets Archaeology: Scans git history, tracked .env files, and CI configs for leaked credentials like AWS keys, GitHub tokens, and Slack tokens. - Supply Chain & Pipeline Security: Audits dependencies for CVEs and install scripts, and checks CI/CD workflows for unpinned actions, pull_request_target abuse, and script injection. - OWASP & Threat Modeling: Covers OWASP Top 10, STRIDE threat modeling, and infrastructure shadow surface analysis (Dockerfiles, IaC, config files with prod credentials). - Use Case: Before a release, run a full daily audit with an 8/10 confidence gate to catch high-signal issues, or run a monthly comprehensive deep scan with a 2/10 bar to surface lower-confidence findings across the entire repository. ## Quick Start Ask the assistant to run a security audit of this repository using the cso skill and report the findings with severity ratings.