What problem does it solve?
This skill helps you catch security risk early by running an infrastructure-first audit that focuses on real-world failure modes like secrets exposure, dependency and CI/CD weaknesses, and LLM/AI specific attack surfaces.
Core Features & Use Cases
- Secrets archaeology: identifies exposed credentials and sensitive artifacts in the codebase and workflow surfaces so you can stop leaks before they ship.
- Dependency supply chain security: evaluates vulnerable and risky dependencies and common transitive-pattern pitfalls that attackers exploit through upgrades.
- CI/CD pipeline and infrastructure security: reviews how your build and deployment process can be abused through misconfigurations, over-privileged steps, and unsafe automation.
- LLM/AI security and skill supply chain scanning: checks prompt injection, RAG poisoning, tool-calling permissions, and the security posture of installed skills.
- Threat modeling plus active verification: applies OWASP Top 10 and STRIDE-style analysis and then verifies key findings to reduce false positives.
Quick Start
Use the cso skill to run a daily security audit and prioritize high-confidence findings by asking it: "Run a security audit for this repo using Chief Security Officer mode, aiming for daily zero-noise reporting."
