gstack-cso
Security audit workflow for OPC code, providers, plugins, Electron surfaces, local HTTP bridges, filesystem access, and command execution.
소스 정보
- 저장소
- LING71671/Open-ClaudeCode
- 최근 소스 활동
- 2026년 6월 8일 18:43
- 감지된 SKILL.md 언어
- 영어
- 스타
- 970
- 포크
- 1,216
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
SKILL.md 표시 중
SKILL.md
소스 지침 · 읽기 전용 미리보기- name
- gstack-cso
- description
- Security audit workflow for OPC code, providers, plugins, Electron surfaces, local HTTP bridges, filesystem access, and command execution.
- allowed-tools
- ["Read","Grep","Glob","Bash"]
# gstack-cso
Use this skill for a security review with OWASP and STRIDE lenses.
## Scope
Prioritize OPC-specific attack surfaces:
- Electron main/preload/renderer IPC
- Local provider bridges and localhost auth
- API key and token storage
- Plugin, hook, skill, and MCP loading
- Shell command construction and tool permissions
- File reads/writes, path traversal, symlinks, and workspace boundaries
- Prompt injection from web, files, tool output, or plugin content
## Workflow
1. Map the trust boundaries and data flows.
2. Identify assets: secrets, filesystem access, provider credentials, session state, command execution, and user prompts.
3. Review entrypoints that cross boundaries.
4. Test high-confidence concerns with direct code evidence.
5. Ignore speculative issues unless there is a concrete exploit path.
## Output
For each finding include:
- Severity
- Affected file or component
- Exploit scenario
- Evidence
- Recommended remediation
Also include a short "Not Findings" section for checked risks that are already mitigated.
GitHub에서 보기