skills.rest
westkite1201
westkite1201COMMUNITY
Explore all skills by this author →
GitHub

cso

Audits codebases for secrets, supply chain, CI/CD, LLM, and OWASP vulnerabilities.

2|Updated Mar 26, 2026
Search Tags:#owasp#threat modeling#security audit#ci/cd security#supply chain#llm security#secrets scanning
One-click install
npx skills add https://github.com/westkite1201/garden-engine --skill cso-westkite1201
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cso
Source: https://github.com/westkite1201/garden-engine/tree/main/.claude/skills/gstack/cso
Command: npx skills add https://github.com/westkite1201/garden-engine --skill cso-westkite1201

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security reviews often miss the real attack surface: leaked credentials in git history, vulnerable dependencies, misconfigured CI/CD pipelines, unsigned webhooks, and LLM-specific risks like prompt injection. This Skill runs a structured, multi-phase security audit that produces a prioritized Security Posture Report instead of ad-hoc checklist scanning. ## Core Features & Use Cases - Infrastructure-first audit phases: Covers secrets archaeology in git history, dependency supply chain analysis, CI/CD pipeline security, shadow infrastructure, webhook signature verification, and LLM/AI security checks. - Confidence-gated reporting: Daily mode reports only high-confidence findings (8/10 gate) to eliminate noise, while comprehensive mode lowers the bar (2/10) for monthly deep scans. - Flexible scoping: Run targeted audits with flags like --infra, --code, --skills, --supply-chain, --owasp, --diff, or --scope to focus on specific domains or branch changes only. - Use Case: Before a release, run a full audit to catch an unpinned GitHub Action, a .env file accidentally tracked by git, and a webhook endpoint missing HMAC signature verification — all in one report with severity ratings and remediation plans. ## Quick Start Ask the AI to run a full security audit of this repository using the cso skill and report only high-confidence findings.

Frequently Asked Questions about cso

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on my codebase with Claude Code?▼

Invoke the /cso command with no flags to run a full daily audit across all phases with an 8/10 confidence gate. Use /cso --comprehensive for a monthly deep scan that surfaces lower-confidence findings at a 2/10 bar.

What does a CI/CD pipeline security audit check for?▼

It checks GitHub Actions workflows for unpinned third-party actions, dangerous pull_request_target triggers, script injection via github.event context in run steps, secrets exposed as environment variables, and missing CODEOWNERS protection on workflow files.

Can I audit only the changes on my current branch?▼

Yes, pass the --diff flag to constrain every phase to files and configs changed on the current branch versus the base branch. It combines with any scope flag and with --comprehensive mode.

Does the security audit make code changes or send network requests?▼

No, the audit is read-only and produces a Security Posture Report with findings, severity ratings, and remediation plans. Webhook verification is done by tracing code paths, never by making live HTTP requests to endpoints.

What LLM and AI security vulnerabilities does the audit detect?▼

It detects prompt injection vectors where user input flows into system prompts, unsanitized LLM output rendered via innerHTML or dangerouslySetInnerHTML, and overly permissive tool or function calling configurations.

Why does the audit report fewer findings in daily mode?▼

Daily mode applies an 8/10 confidence gate so only high-confidence, actionable findings are reported, eliminating false-positive noise. Comprehensive mode lowers the threshold to 2/10 to surface more speculative issues for periodic review.

Related Skills

Explore More Software Engineering Skills→
ViperJuiceViperJuice
8

library-detection

Detect languages, frameworks, and build tools from package manifests.

Community
Intermediate
nexus-substratenexus-substrate
18

security-scanning

Triage CodeQL and secret scanning alerts, fix findings, and classify secrets.

Official
Advanced
GiantCroissant-LunarGiantCroissant-Lunar

code-analyze

Orchestrate static analysis, security scanning, and dependency checks for .NET codebases.

Official
Advanced
IMIOIMIO
5

security-pentest

Scan SmartWeb staging repositories and HTTP endpoints for security vulnerabilities.

Official
Advanced