Skip to main content

cso

Conducts comprehensive security audits and threat modeling for infrastructure, focusing on CI/CD and AI security.

Install this skill

or
0/100

Security score

The cso skill was audited on Jun 10, 2026 and we found 90 security issues across 4 threat categories. Review the findings below before installing.

Categories Tested

Security Issues

medium line 37

Template literal with variable interpolation in command context

SourceSKILL.md
37```bash
medium line 287

Template literal with variable interpolation in command context

SourceSKILL.md
287```bash
medium line 422

Template literal with variable interpolation in command context

SourceSKILL.md
422```bash
medium line 456

Template literal with variable interpolation in command context

SourceSKILL.md
456echo "before relying on \`gbrain search\` for code questions in this worktree."
medium line 584

Template literal with variable interpolation in command context

SourceSKILL.md
584```bash
medium line 751

Webhook reference - potential data exfiltration

SourceSKILL.md
751The real attack surface isn't your code — it's your dependencies. Most teams audit their own app but forget: exposed env vars in CI logs, stale API keys in git history, forgotten staging servers with
medium line 881

Webhook reference - potential data exfiltration

SourceSKILL.md
881**Code surface:** Use the Grep tool to find endpoints, auth boundaries, external integrations, file upload paths, admin routes, webhook handlers, background jobs, and WebSocket channels. Scope file ex
low line 908

Webhook reference - potential data exfiltration

SourceSKILL.md
908Webhook receivers: N
medium line 975

Webhook reference - potential data exfiltration

SourceSKILL.md
9752. **Webhooks:** Trace handler code to verify whether signature verification exists anywhere in the middleware chain. Do NOT make HTTP requests.
low line 1019

Webhook reference - potential data exfiltration

SourceSKILL.md
10194 HIGH 9/10 UNVERIFIED Integrations Webhook w/o signature verify P6 api/webhooks.ts:24
low line 1150

Webhook reference - potential data exfiltration

SourceSKILL.md
1150"infrastructure": { "ci_workflows": 0, "webhook_receivers": 0, "container_configs": 0, "iac_configs": 0, "deploy_targets": 0, "secret_management": "unknown" }
low line 38

Access to hidden dotfiles in home directory

SourceSKILL.md
38_UPD=$(~/.claude/skills/gstack/bin/gstack-update-check 2>/dev/null || .claude/skills/gstack/bin/gstack-update-check 2>/dev/null || true)
low line 40

Access to hidden dotfiles in home directory

SourceSKILL.md
40mkdir -p ~/.gstack/sessions
low line 41

Access to hidden dotfiles in home directory

SourceSKILL.md
41touch ~/.gstack/sessions/"$PPID"
low line 42

Access to hidden dotfiles in home directory

SourceSKILL.md
42_SESSIONS=$(find ~/.gstack/sessions -mmin -120 -type f 2>/dev/null | wc -l | tr -d ' ')
low line 43

Access to hidden dotfiles in home directory

SourceSKILL.md
43find ~/.gstack/sessions -mmin +120 -type f -exec rm {} + 2>/dev/null || true
low line 44

Access to hidden dotfiles in home directory

SourceSKILL.md
44_PROACTIVE=$(~/.claude/skills/gstack/bin/gstack-config get proactive 2>/dev/null || echo "true")
low line 45

Access to hidden dotfiles in home directory

SourceSKILL.md
45_PROACTIVE_PROMPTED=$([ -f ~/.gstack/.proactive-prompted ] && echo "yes" || echo "no")
low line 48

Access to hidden dotfiles in home directory

SourceSKILL.md
48_SKILL_PREFIX=$(~/.claude/skills/gstack/bin/gstack-config get skill_prefix 2>/dev/null || echo "false")
low line 52

Access to hidden dotfiles in home directory

SourceSKILL.md
52source <(~/.claude/skills/gstack/bin/gstack-repo-mode 2>/dev/null) || true
low line 55

Access to hidden dotfiles in home directory

SourceSKILL.md
55_SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive")
low line 58

Access to hidden dotfiles in home directory

SourceSKILL.md
58_LAKE_SEEN=$([ -f ~/.gstack/.completeness-intro-seen ] && echo "yes" || echo "no")
low line 60

Access to hidden dotfiles in home directory

SourceSKILL.md
60_TEL=$(~/.claude/skills/gstack/bin/gstack-config get telemetry 2>/dev/null || true)
low line 61

Access to hidden dotfiles in home directory

SourceSKILL.md
61_TEL_PROMPTED=$([ -f ~/.gstack/.telemetry-prompted ] && echo "yes" || echo "no")
low line 66

Access to hidden dotfiles in home directory

SourceSKILL.md
66_EXPLAIN_LEVEL=$(~/.claude/skills/gstack/bin/gstack-config get explain_level 2>/dev/null || echo "default")
low line 69

Access to hidden dotfiles in home directory

SourceSKILL.md
69_QUESTION_TUNING=$(~/.claude/skills/gstack/bin/gstack-config get question_tuning 2>/dev/null || echo "false")
low line 71

Access to hidden dotfiles in home directory

SourceSKILL.md
71mkdir -p ~/.gstack/analytics
low line 73

Access to hidden dotfiles in home directory

SourceSKILL.md
73echo '{"skill":"cso","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","repo":"'$(_repo=$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null | tr -cd 'a-zA-Z0-9._-'); echo "${_repo:-unknown}")'
low line 75

Access to hidden dotfiles in home directory

SourceSKILL.md
75for _PF in $(find ~/.gstack/analytics -maxdepth 1 -name '.pending-*' 2>/dev/null); do
low line 77

Access to hidden dotfiles in home directory

SourceSKILL.md
77if [ "$_TEL" != "off" ] && [ -x "~/.claude/skills/gstack/bin/gstack-telemetry-log" ]; then
low line 78

Access to hidden dotfiles in home directory

SourceSKILL.md
78~/.claude/skills/gstack/bin/gstack-telemetry-log --event-type skill_run --skill _pending_finalize --outcome unknown --session-id "$_SESSION_ID" 2>/dev/null || true
low line 84

Access to hidden dotfiles in home directory

SourceSKILL.md
84eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)" 2>/dev/null || true
low line 90

Access to hidden dotfiles in home directory

SourceSKILL.md
90~/.claude/skills/gstack/bin/gstack-learnings-search --limit 3 2>/dev/null || true
low line 95

Access to hidden dotfiles in home directory

SourceSKILL.md
95~/.claude/skills/gstack/bin/gstack-timeline-log '{"skill":"cso","event":"started","branch":"'"$_BRANCH"'","session":"'"$_SESSION_ID"'"}' 2>/dev/null &
low line 100

Access to hidden dotfiles in home directory

SourceSKILL.md
100_ROUTING_DECLINED=$(~/.claude/skills/gstack/bin/gstack-config get routing_declined 2>/dev/null || echo "false")
low line 111

Access to hidden dotfiles in home directory

SourceSKILL.md
111_CHECKPOINT_MODE=$(~/.claude/skills/gstack/bin/gstack-config get checkpoint_mode 2>/dev/null || echo "explicit")
low line 112

Access to hidden dotfiles in home directory

SourceSKILL.md
112_CHECKPOINT_PUSH=$(~/.claude/skills/gstack/bin/gstack-config get checkpoint_push 2>/dev/null || echo "false")
medium line 133

Access to hidden dotfiles in home directory

SourceSKILL.md
133In plan mode, allowed because they inform the plan: `$B`, `$D`, `codex exec`/`codex review`, writes to `~/.gstack/`, writes to the plan file, and `open` for generated artifacts.
medium line 141

Access to hidden dotfiles in home directory

SourceSKILL.md
141If `SKILL_PREFIX` is `"true"`, suggest/invoke `/gstack-*` names. Disk paths stay `~/.claude/skills/gstack/[skill-name]/SKILL.md`.
medium line 143

Access to hidden dotfiles in home directory

SourceSKILL.md
143If output shows `UPGRADE_AVAILABLE <old> <new>`: read `~/.claude/skills/gstack/gstack-upgrade/SKILL.md` and follow the "Inline upgrade flow" (auto-upgrade if configured, otherwise AskUserQuestion with
medium line 148

Access to hidden dotfiles in home directory

SourceSKILL.md
148- Missing `~/.claude/skills/gstack/.feature-prompted-continuous-checkpoint`: AskUserQuestion for Continuous checkpoint auto-commits. If accepted, run `~/.claude/skills/gstack/bin/gstack-config set che
medium line 149

Access to hidden dotfiles in home directory

SourceSKILL.md
149- Missing `~/.claude/skills/gstack/.feature-prompted-model-overlay`: inform "Model overlays are active. MODEL_OVERLAY shows the patch." Always touch marker.
medium line 162

Access to hidden dotfiles in home directory

SourceSKILL.md
162If B: run `~/.claude/skills/gstack/bin/gstack-config set explain_level terse`.
low line 166

Access to hidden dotfiles in home directory

SourceSKILL.md
166rm -f ~/.gstack/.writing-style-prompt-pending
low line 167

Access to hidden dotfiles in home directory

SourceSKILL.md
167touch ~/.gstack/.writing-style-prompted
low line 176

Access to hidden dotfiles in home directory

SourceSKILL.md
176touch ~/.gstack/.completeness-intro-seen
medium line 189

Access to hidden dotfiles in home directory

SourceSKILL.md
189If A: run `~/.claude/skills/gstack/bin/gstack-config set telemetry community`
medium line 199

Access to hidden dotfiles in home directory

SourceSKILL.md
199If B→A: run `~/.claude/skills/gstack/bin/gstack-config set telemetry anonymous`
medium line 200

Access to hidden dotfiles in home directory

SourceSKILL.md
200If B→B: run `~/.claude/skills/gstack/bin/gstack-config set telemetry off`
low line 204

Access to hidden dotfiles in home directory

SourceSKILL.md
204touch ~/.gstack/.telemetry-prompted
medium line 217

Access to hidden dotfiles in home directory

SourceSKILL.md
217If A: run `~/.claude/skills/gstack/bin/gstack-config set proactive true`
medium line 218

Access to hidden dotfiles in home directory

SourceSKILL.md
218If B: run `~/.claude/skills/gstack/bin/gstack-config set proactive false`
low line 222

Access to hidden dotfiles in home directory

SourceSKILL.md
222touch ~/.gstack/.proactive-prompted
medium line 264

Access to hidden dotfiles in home directory

SourceSKILL.md
264If B: run `~/.claude/skills/gstack/bin/gstack-config set routing_declined true` and say they can re-enable with `gstack-config set routing_declined false`.
medium line 268

Access to hidden dotfiles in home directory

SourceSKILL.md
268If `VENDORED_GSTACK` is `yes`, warn once via AskUserQuestion unless `~/.gstack/.vendoring-warned-$SLUG` exists:
medium line 280

Access to hidden dotfiles in home directory

SourceSKILL.md
2803. Run `~/.claude/skills/gstack/bin/gstack-team-init required` (or `optional`)
medium line 282

Access to hidden dotfiles in home directory

SourceSKILL.md
2825. Tell the user: "Done. Each developer now runs: `cd ~/.claude/skills/gstack && ./setup --team`"
low line 288

Access to hidden dotfiles in home directory

SourceSKILL.md
288eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)" 2>/dev/null || true
low line 289

Access to hidden dotfiles in home directory

SourceSKILL.md
289touch ~/.gstack/.vendoring-warned-${SLUG:-unknown}
low line 431

Access to hidden dotfiles in home directory

SourceSKILL.md
431_BRAIN_SYNC_BIN="~/.claude/skills/gstack/bin/gstack-brain-sync"
low line 432

Access to hidden dotfiles in home directory

SourceSKILL.md
432_BRAIN_CONFIG_BIN="~/.claude/skills/gstack/bin/gstack-config"
medium line 536

Access to hidden dotfiles in home directory

SourceSKILL.md
536If A/B and `~/.gstack/.git` is missing, ask whether to run `gstack-artifacts-init`. Do not block the skill.
low line 541

Access to hidden dotfiles in home directory

SourceSKILL.md
541"~/.claude/skills/gstack/bin/gstack-brain-sync" --discover-new 2>/dev/null || true
low line 542

Access to hidden dotfiles in home directory

SourceSKILL.md
542"~/.claude/skills/gstack/bin/gstack-brain-sync" --once 2>/dev/null || true
low line 585

Access to hidden dotfiles in home directory

SourceSKILL.md
585eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)"
low line 602

Access to hidden dotfiles in home directory

SourceSKILL.md
602~/.claude/skills/gstack/bin/gstack-decision-search --recent 5 2>/dev/null
medium line 611

Access to hidden dotfiles in home directory

SourceSKILL.md
611**Cross-session decisions.** If `ACTIVE DECISIONS` are listed, treat them as prior settled calls with their rationale — do not silently re-litigate them; if you're about to reverse one, say so explici
medium line 624

Access to hidden dotfiles in home directory

SourceSKILL.md
624Curated jargon list lives at `~/.claude/skills/gstack/scripts/jargon-list.json` (80+ terms). On the first jargon term you encounter this session, Read that file once; treat the `terms` array as the ca
medium line 670

Access to hidden dotfiles in home directory

SourceSKILL.md
670Before each AskUserQuestion, choose `question_id` from `scripts/question-registry.ts` or `{skill}-{slug}`, then run `~/.claude/skills/gstack/bin/gstack-question-preference --check "<id>"`. `AUTO_DECID
low line 678

Access to hidden dotfiles in home directory

SourceSKILL.md
678~/.claude/skills/gstack/bin/gstack-question-log '{"skill":"cso","question_id":"<id>","question_summary":"<short>","category":"<approval|clarification|routing|cherry-pick|feedback-loop>","door_type":"<
low line 687

Access to hidden dotfiles in home directory

SourceSKILL.md
687~/.claude/skills/gstack/bin/gstack-question-preference --write '{"question_id":"<id>","preference":"<pref>","source":"inline-user","free_text":"<optional original words>"}'
low line 707

Access to hidden dotfiles in home directory

SourceSKILL.md
707~/.claude/skills/gstack/bin/gstack-learnings-log '{"skill":"SKILL_NAME","type":"operational","key":"SHORT_KEY","insight":"DESCRIPTION","confidence":N,"source":"observed"}'
medium line 717

Access to hidden dotfiles in home directory

SourceSKILL.md
717`~/.gstack/analytics/`, matching preamble analytics writes.
low line 724

Access to hidden dotfiles in home directory

SourceSKILL.md
724rm -f ~/.gstack/analytics/.pending-"$_SESSION_ID" 2>/dev/null || true
low line 726

Access to hidden dotfiles in home directory

SourceSKILL.md
726~/.claude/skills/gstack/bin/gstack-timeline-log '{"skill":"SKILL_NAME","event":"completed","branch":"'$(git branch --show-current 2>/dev/null || echo unknown)'","outcome":"OUTCOME","duration_s":"'"$_T
low line 729

Access to hidden dotfiles in home directory

SourceSKILL.md
729echo '{"skill":"SKILL_NAME","duration_s":"'"$_TEL_DUR"'","outcome":"OUTCOME","browse":"USED_BROWSE","session":"'"$_SESSION_ID"'","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> ~/.gstack/analytics/skill-
low line 732

Access to hidden dotfiles in home directory

SourceSKILL.md
732if [ "$_TEL" != "off" ] && [ -x ~/.claude/skills/gstack/bin/gstack-telemetry-log ]; then
low line 733

Access to hidden dotfiles in home directory

SourceSKILL.md
733~/.claude/skills/gstack/bin/gstack-telemetry-log \
low line 844

Access to hidden dotfiles in home directory

SourceSKILL.md
844_CROSS_PROJ=$(~/.claude/skills/gstack/bin/gstack-config get cross_project_learnings 2>/dev/null || echo "unset")
low line 847

Access to hidden dotfiles in home directory

SourceSKILL.md
847~/.claude/skills/gstack/bin/gstack-learnings-search --limit 10 --cross-project 2>/dev/null || true
low line 849

Access to hidden dotfiles in home directory

SourceSKILL.md
849~/.claude/skills/gstack/bin/gstack-learnings-search --limit 10 2>/dev/null || true
medium line 864

Access to hidden dotfiles in home directory

SourceSKILL.md
864If A: run `~/.claude/skills/gstack/bin/gstack-config set cross_project_learnings true`
medium line 865

Access to hidden dotfiles in home directory

SourceSKILL.md
865If B: run `~/.claude/skills/gstack/bin/gstack-config set cross_project_learnings false`
medium line 915

Access to hidden dotfiles in home directory

SourceSKILL.md
915> **STOP.** Before running the scope-dependent audit phases (Phases 2-11) selected by the resolved mode, after the Phase 0 stack detection and Phase 1 attack-surface census, Read `~/.claude/skills/gst
medium line 1068

Access to hidden dotfiles in home directory

SourceSKILL.md
1068`~/.gstack-dev/plans/1539-framework-aware-review.md` design doc.
low line 1199

Access to hidden dotfiles in home directory

SourceSKILL.md
1199~/.claude/skills/gstack/bin/gstack-learnings-log '{"skill":"cso","type":"TYPE","key":"SHORT_KEY","insight":"DESCRIPTION","confidence":N,"source":"SOURCE","files":["path/to/relevant/file"]}'
low line 889

Access to .env file

SourceSKILL.md
889ls .env .env.* 2>/dev/null
low line 1016

Access to .env file

SourceSKILL.md
10161 CRIT 9/10 VERIFIED Secrets AWS key in git history P2 .env:3
low line 172

External URL reference

SourceSKILL.md
172If `LAKE_INTRO` is `no`: say "gstack follows the **Boil the Ocean** principle — do the complete thing when AI makes marginal cost near-zero. Read more: https://garryslist.org/posts/boil-the-ocean" Off
low line 175

External URL reference

SourceSKILL.md
175open https://garryslist.org/posts/boil-the-ocean
Scanned on Jun 10, 2026
View Security Dashboard
Installation guide →
GitHub Stars 104.9K
Rate this skill
Categorydevelopment
UpdatedJune 10, 2026
claudeclaude-codecodexclinefrontenddesignstripereactdocxgitapidatabasetestingdevopsbackendsecurity-engineercfo-fpacompliance-officerdevelopmentfinance accountinglegal
garrytan/gstack