cso

Conducts comprehensive security audits and threat modeling for infrastructure, focusing on CI/CD and AI security.

Install this skill

0/100

Security score

The cso skill was audited on May 12, 2026 and we found 109 security issues across 5 threat categories, including 4 critical. Review the findings below before installing.

Categories Tested

Security Issues

critical line 1019

Direct command execution function call

SourceSKILL.md

1019	- Eval/exec of LLM output: `eval()`, `exec()`, `Function()`, `new Function` processing AI responses

critical line 1074

Direct command execution function call

SourceSKILL.md

1074	- Command injection: system(), exec(), spawn(), popen

critical line 1019

Eval function call - arbitrary code execution

SourceSKILL.md

1019	- Eval/exec of LLM output: `eval()`, `exec()`, `Function()`, `new Function` processing AI responses

critical line 1075

Eval function call - arbitrary code execution

SourceSKILL.md

1075	- Template injection: render with params, eval(), html_safe, raw()

medium line 32

Template literal with variable interpolation in command context

SourceSKILL.md

```bash

medium line 265

Template literal with variable interpolation in command context

SourceSKILL.md

265

```bash

medium line 361

Template literal with variable interpolation in command context

SourceSKILL.md

361

```bash

medium line 395

Template literal with variable interpolation in command context

SourceSKILL.md

395	echo "before relying on \`gbrain search\` for code questions in this worktree."

medium line 523

Template literal with variable interpolation in command context

SourceSKILL.md

523

```bash

medium line 930

Template literal with variable interpolation in command context

SourceSKILL.md

930

```bash

high line 976

Template literal with variable interpolation in command context

SourceSKILL.md

976	Severity: CRITICAL for `pull_request_target` + checkout of PR code / script injection via `${{ github.event.*.body }}` in `run:` steps. HIGH for unpinned third-party actions / secrets as env vars

high line 1074

System command execution

SourceSKILL.md

1074	- Command injection: system(), exec(), spawn(), popen

medium line 758

Webhook reference - potential data exfiltration

SourceSKILL.md

758	The real attack surface isn't your code — it's your dependencies. Most teams audit their own app but forget: exposed env vars in CI logs, stale API keys in git history, forgotten staging servers with

medium line 876

Webhook reference - potential data exfiltration

SourceSKILL.md

876	Code surface: Use the Grep tool to find endpoints, auth boundaries, external integrations, file upload paths, admin routes, webhook handlers, background jobs, and WebSocket channels. Scope file ex

low line 903

Webhook reference - potential data exfiltration

SourceSKILL.md

903	Webhook receivers: N

medium line 994

Webhook reference - potential data exfiltration

SourceSKILL.md

994	### Phase 6: Webhook & Integration Audit

medium line 998

Webhook reference - potential data exfiltration

SourceSKILL.md

998	Webhook routes: Use Grep to find files containing webhook/hook/callback route patterns. For each file, check whether it also contains signature verification (signature, hmac, verify, digest, x-hub

medium line 1004

Webhook reference - potential data exfiltration

SourceSKILL.md

1004	Verification approach (code-tracing only — NO live requests): For webhook findings, trace the handler code to determine if signature verification exists anywhere in the middleware chain (parent ro

medium line 1006

Webhook reference - potential data exfiltration

SourceSKILL.md

1006	Severity: CRITICAL for webhooks without any signature verification. HIGH for TLS verification disabled in prod code / overly broad OAuth scopes. MEDIUM for undocumented outbound data flows to thir

medium line 1008

Webhook reference - potential data exfiltration

SourceSKILL.md

1008	FP rules: TLS disabled in test code excluded. Internal service-to-service webhooks on private networks = MEDIUM max. Webhook endpoints behind API gateway that handles signature verification upstre

medium line 1210

Webhook reference - potential data exfiltration

SourceSKILL.md

1210	2. Webhooks: Trace handler code to verify whether signature verification exists anywhere in the middleware chain. Do NOT make HTTP requests.

low line 1254

Webhook reference - potential data exfiltration

SourceSKILL.md

1254	4 HIGH 9/10 UNVERIFIED Integrations Webhook w/o signature verify P6 api/webhooks.ts:24

low line 1348

Webhook reference - potential data exfiltration

SourceSKILL.md

1348	"infrastructure": { "ci_workflows": 0, "webhook_receivers": 0, "container_configs": 0, "iac_configs": 0, "deploy_targets": 0, "secret_management": "unknown" }

low line 33