cso

name	cso
description	Chief Security Officer mode — multi-phase security audit covering OWASP, STRIDE, secrets, CI/CD, and LLM attack surfaces
version	0.1.0
level	3
triggers	["/cso","security audit","check for vulnerabilities","run a security review","full security scan"]
context_files	["context/project.md","context/security-standards.md"]
steps	[{"name":"Architecture Detection","description":"Phase 0 — map data flows, trust boundaries, and component interactions before scanning anything"},{"name":"Entry Point Inventory","description":"Phase 1 — enumerate APIs, webhooks, CLI, file ingestion, and env var exposure"},{"name":"Secrets Archaeology","description":"Phase 2 — scan git history for credential prefixes, tracked .env files, and inline CI credentials"},{"name":"Dependency Vulnerabilities","description":"Phase 3 — check manifests against known CVEs"},{"name":"CI/CD Security","description":"Phase 4 — unpinned actions, dangerous pull_request_target, script injection, missing CODEOWNERS"},{"name":"Infrastructure and Webhooks","description":"Phases 5 and 6 — configuration audit, webhook and integration verification"},{"name":"LLM Attack Surfaces","description":"Phase 7 — prompt injection, unsanitized output rendering, tool-call validation, AI API key exposure"},{"name":"Supply Chain","description":"Phase 8 — scan SKILL.md and agent files for exfiltration, credential access, prompt injection"},{"name":"OWASP Top 10","description":"Phase 9 — systematic coverage of A01 through A10"},{"name":"STRIDE Threat Model","description":"Phase 10 — Spoofing, Tampering, Repudiation, Information Disclosure, DoS (cost-only), Elevation of Privilege"},{"name":"Data Classification","description":"Phase 11 — PII, credentials, and keys in logs or storage"},{"name":"False Positive Filtering","description":"Phase 12 — every finding must have a concrete step-by-step exploit path; drop theoretical risks"},{"name":"Independent Verification","description":"Phase 13 — spawn security-reviewer agent to verify findings before reporting"},{"name":"Report Generation","description":"Phase 14 — structured findings with severity, confidence, and remediation; save to context/security-reports/"}]

CSO Skill

A Chief Security Officer-grade audit that covers every meaningful attack surface: OWASP Top 10, STRIDE threat modeling, secrets archaeology, CI/CD pipeline security, LLM-specific vulnerabilities, and supply chain risks. The output is a verified, actionable report, not a theoretical checklist.

What Claude Gets Wrong Without This Skill

Without a structured audit protocol, security reviews drift toward the obvious. SQL injection gets flagged; prompt injection in an AI pipeline does not. Hardcoded credentials in source are caught; credentials baked into git history are missed. CI/CD pipeline injection via untrusted event data goes unexamined entirely.

The other failure mode is noise: theoretical findings with no realistic exploit path, flagging the absence of hardening rather than the presence of a flaw. Both failures waste time and erode trust in the audit.

This skill enforces a systematic 15-phase protocol that starts with architecture understanding, ends with independent verification, and drops findings that cannot survive the exploit-path test.

Flags

/cso                    # Full audit (confidence threshold: 8/10)
/cso --comprehensive    # Deep audit (confidence threshold: 2/10)
/cso --owasp            # OWASP Top 10 only
/cso --infra            # Infrastructure and CI/CD only
/cso --code             # Code security only
/cso --supply-chain     # Dependency and third-party skills only
/cso --diff             # Current branch changes only (combinable)
/cso --scope <domain>   # Focused on a specific domain

Scope flags are mutually exclusive. Error immediately on incompatible combinations.

Phase 0 Is Mandatory

Regardless of flags, Phase 0 always runs first. You cannot audit what you do not understand. Map the application architecture: data flows, trust boundaries, authentication and authorization design, external integrations, and the components that process untrusted input. This is the mental model everything else depends on.

A rushed Phase 0 produces a rushed audit.

The 15-Phase Protocol

Phase	Name	What It Examines
0	Architecture detection	Data flows, trust boundaries, component interactions
1	Entry point inventory	APIs, webhooks, CLI, file ingestion, env vars
2	Secrets archaeology	Git history credential prefixes (AKIA, sk-, ghp_, xoxb-, AIza), tracked .env files, inline CI credentials
3	Dependency vulnerabilities	Package manifests against known CVEs