cso

Audit infrastructure security, dependency integrity, and CI/CD controls.

Updated Apr 16, 2026

Search Tags:#owasp #infrastructure #supply-chain #stride #security-audit #risk-analysis #ci-cd-security

Ready to run

npx skills add https://github.com/vib795/copilot-anatomy --skill cso-vib795

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cso
Source: https://github.com/vib795/copilot-anatomy/tree/main/.github/skills/gstack-cso
Command: npx skills add https://github.com/vib795/copilot-anatomy --skill cso-vib795

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Infrastructure-first security audits to surface secrets, supply-chain weaknesses, CI/CD risks, and LLM/AI security gaps before they become incidents. It provides threat modeling, active verification, and trend tracking to improve security posture over time.

Core Features & Use Cases

Secrets archaeology across the tech stack to surface hidden credentials
Dependency supply chain scanning and CI/CD pipeline security checks
OWASP Top 10, STRIDE threat modeling, and active verification
Trend tracking across audit runs to monitor improvements and regressions

Quick Start

Run the daily CSO security audit workflow to generate a security posture report and review results.

Frequently Asked Questions about cso

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run an infrastructure security audit for OWASP Top 10 and STRIDE threat modeling?▼

Run the daily CSO security audit workflow to perform infrastructure security analysis, generate a posture report covering OWASP Top 10, STRIDE threat modeling, and active verification, and review the surfaced risks.

What is the best way to scan for secrets and supply-chain risks in my CI/CD pipeline?▼

To scan for secrets and supply-chain risks in your CI/CD pipeline, use the CSO audit to perform secrets archaeology, dependency scanning, and CI/CD controls analysis, surfacing hidden credentials and pipeline weaknesses.

How does trend tracking work across multiple security audit runs?▼

Trend tracking across security audit runs works by logging posture results over time, allowing you to monitor security improvements and regressions across daily hygiene checks and monthly deep scans.

Does the security audit cover LLM and AI security gaps?▼

Yes, the security audit covers LLM and AI security gaps by actively verifying infrastructure controls and dependency integrity to surface AI-specific risks before they become incidents.

Can I use this for daily hygiene checks as well as monthly deep scans?▼

Yes, you can use the mode-based operation for both daily hygiene checks and monthly deep scans, targeting end-to-end security coverage across infrastructure, dependencies, and CI/CD controls.

What actionable risk information does an end-to-end security posture audit provide?▼

An end-to-end security posture audit provides actionable risk information by analyzing infrastructure security, dependency integrity, and CI/CD controls, surfacing secrets, supply-chain weaknesses, and threat modeling results.