skills.rest
RavitejaKarra24
RavitejaKarra24COMMUNITY
Explore all skills by this author →
𝕏@RavitejaKarra24GitHub

cso

Audits codebases for secrets, supply chain risks, OWASP Top 10 vulnerabilities, and STRIDE threats.

Updated Mar 12, 2026
Search Tags:#owasp#vulnerability assessment#threat modeling#security audit#ci/cd security#supply chain#secrets scanning
One-click install
npx skills add https://github.com/RavitejaKarra24/dotfiles --skill cso-ravitejakarra24
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cso
Source: https://github.com/RavitejaKarra24/dotfiles/tree/main/agents/.agents/skills/cso
Command: npx skills add https://github.com/RavitejaKarra24/dotfiles --skill cso-ravitejakarra24

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security reviews are often skipped or shallow because manual audits are slow and noisy. This Skill runs a structured, infrastructure-first security audit across your codebase, dependencies, CI/CD pipelines, LLM integrations, and installed agent skills, then filters findings through a confidence gate so you only see verified, actionable issues. ## Core Features & Use Cases - Phased audit coverage: 15 phases spanning secrets archaeology, dependency supply chain, CI/CD pipeline security, webhook validation, LLM/AI security, skill supply chain scanning, OWASP Top 10:2025, and STRIDE threat modeling. - Two noise-controlled modes: daily mode with an 8/10 confidence gate for zero-noise results, and comprehensive mode with a 2/10 bar for monthly deep scans, plus scoped flags like --diff, --infra, --code, and --supply-chain. - Verified findings with remediation: every finding includes severity, confidence score, exploit scenario, evidence, and a prioritized remediation roadmap saved to .superstack/security-reports/ for tracking over time. - Use Case: Before a production launch, run a full audit to catch a committed API key in git history, an unpinned GitHub Action, and a missing webhook signature check, then fix the P0 issues immediately. ## Quick Start Ask the assistant to run a security audit on this project and choose the full audit scope when prompted.

Frequently Asked Questions about cso

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on my codebase?▼

Invoke the skill with /cso and choose a scope when prompted, such as full audit, infrastructure only, code only, supply chain, or diff only. The audit runs through phased checks and reports only findings that pass the confidence gate.

What does the CSO security audit check for?▼

It scans for leaked secrets in code and git history, vulnerable or typosquatted dependencies, unpinned GitHub Actions, insecure webhooks, LLM prompt injection risks, malicious installed skills, and all OWASP Top 10:2025 categories, plus a STRIDE threat model.

What is the difference between daily and comprehensive audit mode?▼

Daily mode is the default and only reports findings at 8/10 confidence or higher for zero-noise results. Comprehensive mode, triggered with --comprehensive, lowers the bar to 2/10 so even speculative issues are reported and clearly labeled.

Can I audit only the files changed in my branch?▼

Yes, use the --diff flag to restrict the audit to files returned by git diff against main. You can also combine it with other flags, for example --diff --comprehensive, to deep-scan only changed files.

Does the audit produce false positives?▼

The skill applies a hard exclusion list of 22 non-vulnerability patterns, a precedent database for common ambiguous cases, and active verification steps like data-flow tracing before reporting. Findings below the confidence gate are filtered out.

Where are security audit reports saved?▼

Reports are saved to .superstack/security-reports/ as dated Markdown files named by project slug. A history.md file tracks finding counts over time, highlighting new, resolved, and persistent findings between audits.

Related Skills

Explore More Software Engineering Skills→
chris-prenerchris-prener

python-ci

Configures GitHub Actions CI/CD workflows for Python projects with uv, ruff, mypy, and pytest.

Community
Intermediate
trevorbyrumtrevorbyrum
1

security-review

Audit codebases for security vulnerabilities and prioritize findings into P0, P1, and P2 tiers.

Community
Advanced
strawgatestrawgate

kani

Generate and audit Kani proof harnesses for Rust codebases.

Community
Advanced
dralgorhythmdralgorhythm
111

dependency-management

Audit and update project dependencies with lockfile maintenance across Node.js, Python, Go, and Rust.

Community
Intermediate