sj-cso

What problem does it solve?

Manual security audits are inconsistent, time-consuming, and often miss critical vulnerabilities that leave applications exposed to attacks like data breaches and unauthorized access. This Skill automates standardized security checks to catch gaps systematically before deployment.

Core Features & Use Cases

• Automated OWASP Top 10 Scanning: Runs targeted code searches for all 10 OWASP risk categories, including broken access control, injection flaws, cryptographic failures, and SSRF vulnerabilities.
• STRIDE Threat Modeling: Maps spoofing, tampering, repudiation, information disclosure, denial of service, and privilege elevation threats to your system components with concrete attack scenarios and mitigation steps.
• False Positive Filtering: Includes 17 built-in exclusion rules to ignore non-issues like test file hardcodes, environment variable values, and localhost references, reducing alert fatigue for security teams.
• Use Case: A development team preparing to launch a new user authentication feature can use this Skill to run a full security audit, catching issues like unauthenticated admin endpoints or hardcoded API secrets before they reach production.

Quick Start

Use the sj-cso skill to run a full security audit of the current codebase and generate a prioritized vulnerability report with confidence scores.