# gstack CSO Security Audit (cso)

> Evidence-first security audit via the gstack-cso helper that reports supported findings; comprehensive mode adds reproduction and repair candidates.

- Category: [Security Audit](https://www.myskills.tools/en/categories/security-audit/)
- Source: Community · Garry Tan
- Repository: https://github.com/garrytan/gstack/tree/main/cso (commit 7dc2f23 · v3.0.0)
- SKILL.md: https://github.com/garrytan/gstack/blob/main/cso/SKILL.md
- Install command: `npx skills add garrytan/gstack --skill cso`
- License: MIT
- Compatible with: Claude Code, Codex, Cursor, Copilot
- Permissions: read-repo ✓, write-files ✗, shell ✓, network ✓
- Status: Scan passed
- A rule scan cannot catch every risk. Read this skill's SKILL.md and check its permissions before installing.
- ⚠ Requires the gstack-cso launcher; comprehensive mode runs the app in local Docker, and redacted reports are kept for 30 days.

## Core rule

Evidence before assurance: report only findings with an attacker-controlled entrypoint, a crossed security boundary and demonstrated impact.

## Execution Phases

1. **Resolve mode and start** — Resolve scope and flags, start exactly one run through the trusted launcher, and read source only via the helper's inspect, read and history.
2. **Model and census** — Map actors, assets, entrypoints, tenant boundaries and security invariants, and record the attack surface such as endpoints, uploads, webhooks and CI/CD.
3. **Run scoped phases** — Run the audit phases for the selected scope, such as infrastructure, code, skills, supply chain or OWASP.
4. **Evidence and challenge** — Judge severity, confidence and evidence separately, challenge each candidate with an independent reviewer or a separate skeptical pass, and sweep sibling sites.
5. **Report and recheck** — Open the report with complete, partial or not assessed, show a findings table, persist it via the helper, and use resume, replay or recheck later.

## Permissions (summarised from SKILL.md)

| Capability | Needed | Details |
|---|---|---|
| File writes | Not required | Does not change the branch or project source; the helper stores reports and repair candidates in a private state directory. |
| Command execution | Limited | Only the gstack-cso launcher may run; target tools and Docker are never run directly on the host. |
| Network outbound | Limited | Queries only public package and advisory IDs; --offline disables all network access. |

## SKILL.md frontmatter (YAML)

```yaml
---
name: cso
version: 3.0.0
description: "Security audit: supported static findings; qualified profiles add reproduction and repair candidates. (gstack)"
allowed-tools:
  - "Bash(~/.claude/skills/gstack/bin/gstack-cso-launcher *)"
  - "Bash(~/.claude/skills/gstack/bin/gstack-cso-launcher.exe *)"
triggers:
  - security audit
  - check for vulnerabilities
  - owasp review
---
```

Home: https://www.myskills.tools/en/ · URL: https://www.myskills.tools/en/skills/cso/