Audit infrastructure security posture across secrets, dependencies, CI/CD, and LLM/AI.
npx skills add https://github.com/olaafrossi/FoamPilot --skill cso-olaafrossi
Please help me install this Agent Skill. Skill: cso Source: https://github.com/olaafrossi/FoamPilot/tree/main/.claude/skills/cso Command: npx skills add https://github.com/olaafrossi/FoamPilot --skill cso-olaafrossi
Infrastructure-first security audits that help chief security officers and security teams uncover secrets, insecure dependencies, CI/CD risks, LLM/AI security gaps, and misconfigurations across the tech stack.
Run a daily audit with /cso to start infrastructure-first security checks.
High-intent search queries and answers about installing and using this skill.
You can automate infrastructure security audits using a multi-phase workflow that scans for leaked secrets and dependency supply chain risks. It leverages tools like Bash, Grep, and Glob to perform automated checks across your tech stack.
Threat modeling for CI/CD pipelines involves applying OWASP Top 10 and STRIDE methodologies to identify practical attack paths. It actively verifies pipeline security and LLM integrations to defend automations against potential threats.
Yes, you can run daily security posture checks for LLM and AI security gaps. The system supports a daily mode designed to perform targeted checks on secrets archaeology, CI/CD pipeline security, and LLM/AI verifications.
Yes, the security audit tool works without external dependencies. It operates autonomously using built-in allowed tools including Bash, Read, Grep, Glob, Write, Agent, WebSearch, and AskUserQuestion to execute its multi-phase workflow.
The best way to track security posture improvements is through active verification and trend tracking across audit runs. This approach records improvements over time by comparing daily and comprehensive security scan results.
You should use comprehensive mode for deep security audits during pentest reviews or full threat modeling across organizations. Daily mode is suited for routine checks, while comprehensive mode performs extensive infrastructure-first scanning.
miko06Automate security audits, vulnerability scanning, and threat modeling using Bash and security tools.
tyhuffman7Audit infrastructure security for secrets, supply chain, CI/CD, and LLM risks.
smarmen86Automate infrastructure security audits and threat modeling for software projects.
VertaKhanRun infrastructure-first security audits and generate a Security Posture Report.
