# Cso

> Security audit workflow for Codex. Use when a repo, feature, or system should be reviewed for concrete security risks before or after shipping.

- Skill: `mphaxise/cso` (Agent Skill)
- Install (CLI): `npx skillmds@latest add mphaxise/cso`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mphaxise/cso/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: mphaxise (https://skillmd.com/u/mphaxise)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mphaxise/cso

---


# CSO

Use this skill when the user wants a serious security pass instead of generic best-practices advice.

This port is adapted from `garrytan/gstack` at commit `4d2c8d94d00cc4f4f3d4c26316a4f939ceedc045`.

## Workflow

1. Identify the audit scope:
   - application surface
   - infrastructure or CI
   - secrets and auth
   - dependencies and supply chain
2. Review the relevant risks using concrete lenses:
   - trust boundaries
   - data exposure
   - auth and authorization
   - secret handling
   - unsafe defaults
   - exploitable deployment gaps
3. Report only the issues that matter, with a realistic exploit scenario when possible.

## Guardrails

- Do not flood the user with low-confidence noise.
- Distinguish verified issues, likely issues, and open questions.
- Prefer concrete exploit paths over checklist theater.