skills.rest
dhnpmp-tech
dhnpmp-techCOMMUNITY
Explore all skills by this author →
GitHub

cso

Audits codebases for secrets, supply chain, CI/CD, LLM, and OWASP vulnerabilities.

Updated Mar 23, 2026
Search Tags:#owasp#threat modeling#security audit#ci/cd security#supply chain#llm security#secrets scanning
One-click install
npx skills add https://github.com/dhnpmp-tech/project-agent --skill cso-dhnpmp-tech
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cso
Source: https://github.com/dhnpmp-tech/project-agent/tree/main/.claude/skills/gstack/cso
Command: npx skills add https://github.com/dhnpmp-tech/project-agent --skill cso-dhnpmp-tech

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security reviews often miss the real attack surface: leaked credentials in git history, vulnerable dependencies, misconfigured CI/CD pipelines, unsigned webhooks, and LLM-specific risks like prompt injection. This Skill runs a structured, infrastructure-first security audit that produces a concrete Security Posture Report with severity-rated findings and remediation plans. ## Core Features & Use Cases - Multi-phase audit coverage: Secrets archaeology in git history, dependency supply chain analysis, CI/CD pipeline security, Docker/Terraform/Kubernetes infrastructure review, webhook signature verification, LLM/AI security checks, and OWASP Top 10 scanning. - Two confidence modes: A daily zero-noise mode with an 8/10 confidence gate, and a comprehensive monthly deep scan with a 2/10 bar that surfaces more potential issues. - Scoped and diff-aware runs: Limit the audit to infrastructure, code, skill supply chain, dependencies, OWASP, a specific domain, or only files changed on the current branch. - Use Case: Before a release, run a full audit to discover an unpinned third-party GitHub Action, a Stripe webhook missing signature verification, and an old API key still present in git history — each reported with severity and a fix plan. ## Quick Start Ask the AI to run a full security audit of this repository and report only high-confidence findings with severity ratings and remediation steps.

Frequently Asked Questions about cso

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on my codebase with AI?▼

Invoke the audit with no flags for a full daily scan across all phases using an 8/10 confidence gate that only reports high-confidence findings. Add the comprehensive flag for a deeper monthly scan with a lower reporting threshold.

What does a supply chain security audit check beyond npm audit?▼

It checks for install scripts in production dependencies, lockfile existence and git tracking, abandoned packages, and known CVEs in direct dependencies. Standard package manager audit tools are run when available and noted as skipped when not installed.

Can I audit only the files changed on my branch?▼

Yes, the diff flag constrains every phase to files and configs changed on the current branch versus the base branch. For git history scanning, it limits the search to commits on the current branch only.

Does the audit check GitHub Actions workflow security?▼

Yes, it flags unpinned third-party actions, pull_request_target usage with PR code checkout, script injection via GitHub event context in run steps, secrets exposed as environment variables, and missing CODEOWNERS protection on workflow files.

Does the security audit make changes to my code?▼

No, it never modifies code. It produces a Security Posture Report containing concrete findings, severity ratings from critical to medium, false-positive filtering rules, and remediation plans for each issue.

What LLM and AI security risks does the audit detect?▼

It searches for prompt injection vectors where user input flows into system prompts, unsanitized LLM output rendered via innerHTML or similar sinks, and overly permissive tool or function call configurations in AI integrations.

Related Skills

Explore More Software Engineering Skills→
BrownbullBrownbull

devops-orchestrator

Automate infrastructure provisioning, CI/CD pipelines, and deployments across cloud environments.

Community
Advanced
nexus-substratenexus-substrate
18

security-scanning

Triage CodeQL and secret scanning alerts, fix findings, and classify secrets.

Official
Advanced
eclipse-slmeclipse-slm
8

security-scan

Detect hardcoded secrets, vulnerable dependencies, and unpinned GitHub Actions in Ansible collections.

Official
Intermediate
TgoldiTgoldi

SSH Penetration Testing

Tests SSH services through enumeration, credential attacks, exploitation, and tunneling techniques.

Community
Intermediate