Audit codebases for leaked secrets, CI/CD misconfigurations, and vulnerable dependencies.
npx skills add https://github.com/CarbeneAI/Forge --skill cso-carbeneai
Please help me install this Agent Skill. Skill: cso Source: https://github.com/CarbeneAI/Forge/tree/main/.claude/skills/cso Command: npx skills add https://github.com/CarbeneAI/Forge --skill cso-carbeneai
The cso skill performs infrastructure-first security audits to find leaked secrets, CI/CD and workflow misconfigurations, dependency supply-chain risks, exposed infrastructure, and skill supply-chain issues so teams get an actionable Security Posture Report rather than a noisy checklist.
Run /cso in your Claude session to perform a daily infrastructure-first security audit and receive a Security Posture Report with findings and remediation steps.
High-intent search queries and answers about installing and using this skill.
Infrastructure security audits scan your codebase to identify leaked secrets, CI/CD misconfigurations, and vulnerable dependencies, producing a Security Posture Report with severity-rated findings and remediation steps.
A Security Posture Report is the output of an infrastructure security audit, containing severity-rated findings, reproducible evidence, and remediation steps. It provides actionable security insights rather than a noisy checklist of potential issues.
You can run scoped branch-diff limited scans during pull requests to identify security issues in changes. This targets newly introduced leaked secrets, dependency vulnerabilities, and CI/CD misconfigurations without rescanning the entire repository.
Yes, infrastructure security audits explicitly cover dependency supply-chain risks alongside leaked secrets and exposed infrastructure. The scan evaluates vulnerable dependencies and skill supply-chain issues to provide comprehensive risk detection.
You can perform daily zero-noise quick scans as well as comprehensive monthly deep scans. The audit supports multiple scopes including targeted reviews for infrastructure, code, supply-chain, and OWASP vulnerability categories.
Running a comprehensive deep infrastructure security audit maps your attack surface and actively verifies exposed infrastructure and webhooks. It uses Grep-based code searches across targeted phases to identify shadow surfaces and integration vulnerabilities.
RedHatProductSecurityAnalyze GitHub Actions workflows for AI agent security issues.
mrvonkalusScan source files, configurations, and dependencies for security vulnerabilities.
ag47-ptIdentify and prioritize software vulnerabilities across code, dependencies, and configurations.
devendrapratapsinghScan code, containers, and infrastructure for security vulnerabilities.
