What problem does it solve? Security reviews often miss the real attack surface: leaked credentials in git history, vulnerable dependencies, misconfigured CI/CD pipelines, and LLM-specific threats. This Skill runs a structured, multi-phase security audit that produces a prioritized Security Posture Report instead of ad-hoc checklist scanning. ## Core Features & Use Cases - Infrastructure-first auditing: Scans git history for leaked secrets, checks dependency supply chains, reviews CI/CD pipeline security, and maps shadow infrastructure like Dockerfiles and IaC configs. - Code-level analysis: Covers OWASP Top 10, STRIDE threat modeling, LLM/AI security checks (prompt injection, RAG poisoning), and skill supply chain scanning. - Two confidence modes: Daily mode reports only high-confidence findings (8/10 gate) for zero-noise reviews; comprehensive mode (2/10 bar) surfaces everything for monthly deep scans, with trend tracking across runs. - Use Case: Before a release, run /cso --diff to audit only the changes on your branch, or run /cso --comprehensive monthly to catch stale API keys, unpinned GitHub Actions, and vulnerable dependencies across the whole repo. ## Quick Start Ask the AI to run a full security audit of the current repository and produce a prioritized security posture report with severity ratings and remediation steps.
