cso

Audit infrastructure, dependencies, and workflows into a structured Security Posture Report.

Updated Apr 2, 2026

Search Tags:#threat-modeling #supply-chain #risk-management #security-audit #owasp-top-10 #llm-security #ci-cd-security

Ready to run

npx skills add https://github.com/jonkiky/ccdi-federation-ai --skill cso-jonkiky

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cso
Source: https://github.com/jonkiky/ccdi-federation-ai/tree/main/.agents/cso
Command: npx skills add https://github.com/jonkiky/ccdi-federation-ai --skill cso-jonkiky

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security posture is often fragmented across infrastructure, dependencies, and development workflows. This skill audits and consolidates findings into a structured Security Posture Report that helps teams prioritize remediation.

Core Features & Use Cases

Comprehensive infrastructure, dependencies, and code path security audit.
OWASP Top 10 coverage, STRIDE threat modeling, and active verification.
Daily zero-noise audits (8/10 confidence) and monthly deep scans (2/10 bar) with trend tracking.

Quick Start

Ask for a daily audit with /cso to begin the zero-noise scan, or request a monthly deep assessment with /cso --comprehensive.

Frequently Asked Questions about cso

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run a security audit for my infrastructure and dependencies?▼

You can run a daily security audit by initiating a zero-noise scan with an 8/10 confidence gate to assess infrastructure, dependencies, and development workflows for vulnerabilities.

What does STRIDE threat modeling and OWASP Top 10 coverage involve?▼

STRIDE threat modeling and OWASP Top 10 coverage involve monthly deep scans that lower the confidence bar to 2/10, actively verifying security posture and tracking vulnerability trends over time.

Can I use this to audit CI/CD security and LLM-specific vulnerabilities?▼

Yes, you can audit CI/CD security and LLM security by evaluating development workflows and dependency risks, consolidating fragmented findings into a structured Security Posture Report for remediation.

What's the best way to consolidate supply-chain risk management into a single report?▼

Consolidate supply-chain risk management by auditing dependencies and infrastructure, enforcing mode-specific detection gates, and producing a structured Security Posture Report to prioritize remediation.

Does the daily zero-noise audit require an 8/10 confidence threshold?▼

Yes, the daily zero-noise audit enforces an 8/10 confidence gate to minimize false positives, while monthly comprehensive scans lower the bar to 2/10 for broader active verification.