gstack-cso

name	gstack-cso
description	Security audit workflow for OPC code, providers, plugins, Electron surfaces, local HTTP bridges, filesystem access, and command execution.
allowed-tools	["Read","Grep","Glob","Bash"]

gstack-cso

Use this skill for a security review with OWASP and STRIDE lenses.

Scope

Prioritize OPC-specific attack surfaces:

• Electron main/preload/renderer IPC
• Local provider bridges and localhost auth
• API key and token storage
• Plugin, hook, skill, and MCP loading
• Shell command construction and tool permissions
• File reads/writes, path traversal, symlinks, and workspace boundaries
• Prompt injection from web, files, tool output, or plugin content

Workflow

1. Map the trust boundaries and data flows.
2. Identify assets: secrets, filesystem access, provider credentials, session state, command execution, and user prompts.
3. Review entrypoints that cross boundaries.
4. Test high-confidence concerns with direct code evidence.
5. Ignore speculative issues unless there is a concrete exploit path.

Output

For each finding include:

• Severity
• Affected file or component
• Exploit scenario
• Evidence
• Recommended remediation

Also include a short "Not Findings" section for checked risks that are already mitigated.