cso

Map and quantify security posture gaps across infrastructure, CI/CD pipelines, dependencies, and application configurations.

3|3|Updated Mar 26, 2026

Search Tags:#owasp #infrastructure #cso #supply-chain #risk-management #security-audit

Ready to run

npx skills add https://github.com/tsensei/ReelMistri --skill cso-tsensei

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cso
Source: https://github.com/tsensei/ReelMistri/tree/main/.claude/skills/gstack/cso
Command: npx skills add https://github.com/tsensei/ReelMistri --skill cso-tsensei

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Chief Security Officer mode focuses on infrastructure-first security audits to systematically identify misconfigurations, broken controls, and vulnerable dependencies before incidents occur, delivering a comprehensive posture view.

Core Features & Use Cases

Infra-first security audit: Assess CI/CD pipelines, access controls, secret management, and architecture risk.
Supply-chain & OWASP coverage: Review dependency risks, secret exposure, and threat modeling aligned to OWASP Top 10.
Remediation-focused reporting: Provide concrete fixes with evidence and prioritized action plans for stakeholders.

Quick Start

Invoke /cso to run the daily audit with default scope.

Frequently Asked Questions about cso

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform an infrastructure-first security audit for CI/CD pipelines?▼

An infrastructure-first security audit maps and quantifies posture gaps across CI/CD pipelines, access controls, and secret management to identify misconfigurations and architecture risks before incidents occur.

What is supply-chain risk management and how does it review dependencies?▼

Supply-chain risk management reviews dependencies to uncover vulnerable components and secret exposure, mapping these risks against threat models aligned with the OWASP Top 10 to quantify security posture gaps.

How do I check my infrastructure for OWASP Top 10 coverage and misconfigurations?▼

Checking OWASP Top 10 coverage involves evaluating application configurations, access controls, and secret management to detect misconfigurations, quantify security posture gaps, and deliver a structured remediation plan.

Does this security audit provide concrete remediation plans with documented evidence?▼

Yes, the security audit delivers remediation-focused reporting that provides concrete fixes, prioritized action plans for stakeholders, and documented evidence to verify control implementation and risk reduction.

Can I run a daily risk review focused only on access control and secret management?▼

Yes, you can run a daily risk review with a default scope to specifically evaluate access controls and perform secret management checks, systematically identifying broken controls and quantifying risk exposure.