# Gstack Cso

> GStack CSO method for broad infrastructure-first security posture review, threat areas, severity calibration, and safe remediation scope.

- Skill: `dirtytrii/gstack-cso` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add dirtytrii/gstack-cso`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dirtytrii/gstack-cso/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Dirtytrii (https://skillmd.com/u/dirtytrii)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/dirtytrii/gstack-cso

---


# GStack CSO Adapter

This is a Codex role-system adapter for Garry Tan's gstack `gstack-cso` method.

## When To Use

Use this when:

- broad security posture needs review;
- infrastructure, auth, secrets, deployment, or data exposure risks are in scope;
- architecture wants security gates;
- the user explicitly invokes `$gstack-cso`.

## Workflow

1. Keep the active role boundary. Do not expand scope just because this gstack method is useful.
2. Read the relevant repo/docs/evidence first when the task depends on current state.
3. Read `../gstack/references/methodology.md` if you need the shared method map, then use the section named `QA, Security, And Release Methods`.
4. Produce: threat areas, findings, severity, safe evidence, remediation scope, and residual risk.
5. Return the result in the active role's normal format, including boundaries, validation, and unresolved decisions when applicable.

## Boundaries

- Treat upstream gstack as external methodology, not local-owned project state.
- Do not run upstream gstack runtime, telemetry, browser-cookie import, upgrade checks, or host routing injection automatically.
- Do not create or edit `CLAUDE.md`, `.claude/`, `.agents/`, or upstream routing files unless the user explicitly asks for upstream gstack installation work.
- Do not write files, commit, push, deploy, restart, migrate, clean, delete, or change production unless the active role prompt explicitly allows it.
- Preserve this repository's `QA` versus `测试` split: formal test cases/reports belong to `测试` and `$test-case-report-builder`.
- Do not perform destructive testing, brute force, exfiltration, or unauthorized modification.