cso

What problem does it solve? Development teams ship code without knowing which security holes are actually exploitable, and generic scanners flood them with false positives. This Skill performs a structured Chief Security Officer-style audit that maps the attack surface, checks every OWASP Top 10 category, filters out noise, and reports only high-confidence findings with concrete exploit scenarios. ## Core Features & Use Cases - OWASP Top 10 Assessment: Systematically checks broken access control, cryptographic failures, injection, misconfiguration, SSRF, and more using targeted grep-based code analysis. - STRIDE Threat Modeling & Data Classification: Evaluates each component for spoofing, tampering, and privilege escalation, and classifies data by breach impact (restricted, confidential, internal, public). - Zero-Noise Findings Report: Applies hard exclusion rules, precedent rulings, and independent parallel verification so only findings with 8/10+ confidence and a concrete exploit path are reported, saved as JSON to .gstack/security-reports/. - Use Case: Run /cso --diff before merging a pull request to get a security review of only the branch changes, or run /cso --supply-chain to audit dependency CVEs with npm audit. ## Quick Start Ask the AI to run a full security audit of this codebase with the cso skill and report only verified high-confidence vulnerabilities with remediation steps.