skills.rest
Simon-YHKim
Simon-YHKimCOMMUNITY
Explore all skills by this author →
GitHub

cso

Audits codebases for security vulnerabilities and produces a confidence-sorted findings report.

Updated Apr 5, 2026
Search Tags:#vulnerability#owasp#threat modeling#security audit#ci/cd security#supply chain#secrets scanning
One-click install
npx skills add https://github.com/Simon-YHKim/eject-button --skill cso-simon-yhkim
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cso
Source: https://github.com/Simon-YHKim/eject-button/tree/main/.claude/skills/cso
Command: npx skills add https://github.com/Simon-YHKim/eject-button --skill cso-simon-yhkim

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security issues hide in dependencies, CI pipelines, git history, and webhook handlers long before they show up in application code. This Skill runs a structured Chief Security Officer audit across your entire repository so leaked secrets, supply chain risks, and OWASP vulnerabilities surface before attackers find them. ## Core Features & Use Cases - 15-phase audit coverage: secrets archaeology in git history, dependency supply chain, CI/CD pipeline security, infrastructure shadow surface, webhook verification, LLM/AI security, skill supply chain scanning, OWASP Top 10, and STRIDE threat modeling. - Two confidence modes: daily mode with an 8/10 confidence gate for zero-noise findings, and comprehensive mode with a 2/10 bar for monthly deep scans that surface tentative issues. - Scoped and diff-aware runs: target infrastructure only, code only, skill supply chain, or just the changes on your current branch. - Use Case: Before shipping a release, run a full audit to catch an unpinned GitHub Action, a webhook endpoint missing signature verification, and an API key committed three months ago, all in one report sorted by confidence. ## Quick Start Ask the assistant to run a security audit of this repository with the cso skill and report the findings sorted by confidence.

Frequently Asked Questions about cso

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on my codebase?▼

Invoke the skill with no arguments for a full daily audit across all 15 phases with an 8/10 confidence gate. Use the comprehensive flag for a monthly deep scan that lowers the bar to 2/10 and surfaces tentative findings.

What does a CSO security review check beyond OWASP?▼

Beyond the OWASP Top 10, it scans git history for leaked credentials, audits dependency supply chains and install scripts, checks CI/CD workflows for unpinned actions and script injection, verifies webhook signature validation, and covers LLM-specific risks like prompt injection and unsanitized model output.

Can I audit only the changes on my current branch?▼

Yes, the diff flag constrains every phase to files and commits changed on the current branch versus the base branch. It combines with any scope flag and with comprehensive mode.

Does the security audit make code changes automatically?▼

No, it never modifies code. It produces a security posture report with concrete findings, severity ratings, and remediation plans, and the user decides what to fix.

Why does the audit skip some potential vulnerabilities?▼

Daily mode applies an 8/10 confidence gate and hard exclusions for DoS, resource exhaustion, and missing hardening measures to keep the report zero-noise. Run comprehensive mode to surface lower-confidence items flagged as tentative.

Can it scan installed AI agent skills for malicious patterns?▼

Yes, Phase 8 scans repo-local skills automatically for credential access, network exfiltration, and prompt injection patterns. Scanning globally installed skills requires explicit user approval since it reads files outside the repository.

Related Skills

Explore More Software Engineering Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-audit-context-building

Map architecture, trust boundaries, and data flows for security audit scoping.

Official
Advanced
openaiopenai
5.3k

twilio-security-hardening

Secures Twilio applications through credential management, webhook validation, and fraud prevention.

Official
Intermediate
wgpsecwgpsec
1.7k

php-auth-config-audit

Audit PHP source code for authentication, authorization, configuration, cryptography, and business logic vulnerabilities.

Official
Advanced
kalilurrahmankalilurrahman
1

security-testing

Designs security testing programs covering SAST, DAST, dependency scanning, and penetration testing.

Community
Advanced