cso

Conducts comprehensive security audits and threat modeling for infrastructure, focusing on CI/CD and AI security.

Install this skill

0/100

Security score

The cso skill was audited on Jun 9, 2026 and we found 107 security issues across 4 threat categories, including 4 critical. Review the findings below before installing.

Categories Tested

Security Issues

critical line 975

Direct command execution function call

SourceSKILL.md

975	- Eval/exec of LLM output: `eval()`, `exec()`, `Function()`, `new Function` processing AI responses

critical line 1030

Direct command execution function call

SourceSKILL.md

1030	- Command injection: system(), exec(), spawn(), popen

critical line 975

Eval function call - arbitrary code execution

SourceSKILL.md

975	- Eval/exec of LLM output: `eval()`, `exec()`, `Function()`, `new Function` processing AI responses

critical line 1031

Eval function call - arbitrary code execution

SourceSKILL.md

1031	- Template injection: render with params, eval(), html_safe, raw()

medium line 32

Template literal with variable interpolation in command context

SourceSKILL.md

```bash

medium line 265

Template literal with variable interpolation in command context

SourceSKILL.md

265

```bash

medium line 340

Template literal with variable interpolation in command context

SourceSKILL.md

340

```bash

medium line 479

Template literal with variable interpolation in command context

SourceSKILL.md

479

```bash

medium line 886

Template literal with variable interpolation in command context

SourceSKILL.md

886

```bash

high line 932

Template literal with variable interpolation in command context

SourceSKILL.md

932	Severity: CRITICAL for `pull_request_target` + checkout of PR code / script injection via `${{ github.event.*.body }}` in `run:` steps. HIGH for unpinned third-party actions / secrets as env vars

high line 1030

System command execution

SourceSKILL.md

1030	- Command injection: system(), exec(), spawn(), popen

medium line 714

Webhook reference - potential data exfiltration

SourceSKILL.md

714	The real attack surface isn't your code — it's your dependencies. Most teams audit their own app but forget: exposed env vars in CI logs, stale API keys in git history, forgotten staging servers with

medium line 832

Webhook reference - potential data exfiltration

SourceSKILL.md

832	Code surface: Use the Grep tool to find endpoints, auth boundaries, external integrations, file upload paths, admin routes, webhook handlers, background jobs, and WebSocket channels. Scope file ex

low line 859

Webhook reference - potential data exfiltration

SourceSKILL.md

859	Webhook receivers: N

medium line 950

Webhook reference - potential data exfiltration

SourceSKILL.md

950	### Phase 6: Webhook & Integration Audit

medium line 954

Webhook reference - potential data exfiltration

SourceSKILL.md

954	Webhook routes: Use Grep to find files containing webhook/hook/callback route patterns. For each file, check whether it also contains signature verification (signature, hmac, verify, digest, x-hub

medium line 960

Webhook reference - potential data exfiltration

SourceSKILL.md

960	Verification approach (code-tracing only — NO live requests): For webhook findings, trace the handler code to determine if signature verification exists anywhere in the middleware chain (parent ro

medium line 962

Webhook reference - potential data exfiltration

SourceSKILL.md

962	Severity: CRITICAL for webhooks without any signature verification. HIGH for TLS verification disabled in prod code / overly broad OAuth scopes. MEDIUM for undocumented outbound data flows to thir

medium line 964

Webhook reference - potential data exfiltration

SourceSKILL.md

964	FP rules: TLS disabled in test code excluded. Internal service-to-service webhooks on private networks = MEDIUM max. Webhook endpoints behind API gateway that handles signature verification upstre

medium line 1166

Webhook reference - potential data exfiltration

SourceSKILL.md

1166	2. Webhooks: Trace handler code to verify whether signature verification exists anywhere in the middleware chain. Do NOT make HTTP requests.

low line 1210

Webhook reference - potential data exfiltration

SourceSKILL.md

1210	4 HIGH 9/10 UNVERIFIED Integrations Webhook w/o signature verify P6 api/webhooks.ts:24

low line 1304

Webhook reference - potential data exfiltration

SourceSKILL.md

1304	"infrastructure": { "ci_workflows": 0, "webhook_receivers": 0, "container_configs": 0, "iac_configs": 0, "deploy_targets": 0, "secret_management": "unknown" }

low line 33