skills.rest
no-session
no-sessionCOMMUNITY
Explore all skills by this author →
𝕏@pawan_kumar100GitHub

cso

Audits codebases for secrets, supply chain, CI/CD, LLM, and OWASP vulnerabilities.

107|7|Updated Mar 29, 2026
Search Tags:#owasp#threat modeling#security audit#ci/cd security#supply chain#llm security#secrets scanning
One-click install
npx skills add https://github.com/no-session/pstack --skill cso-no-session
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cso
Source: https://github.com/no-session/pstack/tree/main/cso
Command: npx skills add https://github.com/no-session/pstack --skill cso-no-session

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Solo founders and small teams rarely run real security reviews, leaving leaked secrets in git history, vulnerable dependencies, misconfigured CI/CD pipelines, and unverified webhooks undetected until a breach happens. ## Core Features & Use Cases - Infrastructure-first audit: Scans git history for leaked credentials, checks dependency supply chains, CI/CD pipeline security, Docker/IaC misconfigurations, and webhook signature verification. - LLM and skill supply chain security: Detects prompt injection vectors, unsanitized LLM output, unvalidated tool calls, and malicious patterns in installed Claude Code skills. - Two audit modes with confidence gating: Daily mode reports only 8/10-confidence findings for zero noise; comprehensive mode lowers the bar to 2/10 for monthly deep scans, with trend tracking across runs. - Use Case: Before shipping a new SaaS feature, run a scoped audit on the current branch diff to catch hardcoded API keys, unpinned GitHub Actions, and missing webhook signature checks, then receive a Security Posture Report with severity ratings and remediation plans. ## Quick Start Ask the AI to run a full security audit of this repository with /cso and produce a severity-rated Security Posture Report.

Frequently Asked Questions about cso

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on my codebase with Claude Code?▼

Invoke /cso with no flags for a full daily audit across all 15 phases with an 8/10 confidence gate. Use /cso --comprehensive for a monthly deep scan, or scope flags like --infra, --code, --owasp, or --diff to narrow the audit.

What does the cso skill check beyond npm audit?▼

It scans git history for leaked credentials, checks install scripts in production dependencies, verifies lockfile integrity, audits CI/CD workflows for unpinned actions and script injection, and inspects webhooks, Dockerfiles, IaC, and LLM-specific vulnerabilities.

Can I audit only the changes on my current branch?▼

Yes, the --diff flag constrains every phase to files and configs changed on the current branch versus the base branch. It combines with any scope flag and with --comprehensive mode.

Does the security audit support Python, Go, and Ruby projects?▼

Yes, Phase 0 detects Node/TypeScript, Ruby, Python, Go, Rust, JVM, PHP, and .NET stacks plus frameworks like Next.js, Django, Rails, and Gin. Detection sets scan priority, and a catch-all pass still covers undetected languages.

Why does the daily audit report fewer findings than comprehensive mode?▼

Daily mode applies an 8/10 confidence gate so only high-confidence, verified findings are reported, eliminating noise. Comprehensive mode lowers the bar to 2/10, surfacing more speculative findings for monthly deep review.

Does the audit make code changes or live requests to my endpoints?▼

No, the skill never modifies code and never makes live HTTP requests. It produces a Security Posture Report with findings, severity ratings, and remediation plans, verifying webhooks by tracing code only.

Related Skills

Explore More Software Engineering Skills→
ShmurdocShmurdoc

plan-eng-review

Review system design, data flow, and edge cases to lock in execution plans.

Community
Advanced
Jia-Hong-PengJia-Hong-Peng

qa

Automate end-to-end QA testing and bug remediation for web applications.

Community
Advanced
rickyanandarickyananda
1

requesting-code-review

Review staged git diffs for security, logic, and regression issues.

Community
Advanced
sergiomvjsergiomvj

vulnerability-scanner

Scan codebases for dependencies, secrets, code patterns, and configuration risks.

Community
Intermediate