cso

CSO Security Audit

ℹ️ First, set expectations: before anything else, print one short line with this skill's version and its most recent change — the top entry of metadata.changelog above — e.g. cso vX.Y — recent: <summary>. Then proceed.

Run a security audit in Chief Security Officer mode. Two scopes available:

• --diff — scans changes on the current branch vs base. Fast, recommended for every P0/P1 PR.
• --comprehensive — scans the full codebase. Slower, recommended weekly or before major releases.

State Dependencies

Source	Location	Read	Write	Description
Git diff	current branch	✅		Branch changes (--diff mode)
Source code	src/	✅		Full codebase (--comprehensive mode)
Architecture	docs/memory/architecture.md	✅		Auth boundaries, integration points
Dependencies	requirements.txt, package.json, etc.	✅		Dependency inventory
Security reports	docs/security-reports/		✅	Saved output

Arguments

• --diff — scope to branch changes only (default if no argument provided)
• --comprehensive — scope to full codebase

Process

Step 1: Determine Scope

# --diff mode
git diff main...HEAD

# --comprehensive mode
find src/ -type f -name "*.py" -o -name "*.ts" -o -name "*.js"

Step 2: Secrets Scan

Scan for hardcoded credentials in scope:

# API keys and tokens
grep -rE '(sk-[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{36}|AKIA[A-Z0-9]{16})' [scope]

# Generic secrets pattern
grep -rE '(password|secret|token|api_key)\s*[=:]\s*["'"'"'][^"'"'"'\$]{8,}["'"'"']' [scope] | grep -v 'example\|placeholder\|test\|dummy'

# .env files in diff
git diff --name-only | grep -E '^\.env$|\.env\.[^e]' | grep -v example

Severity: CRITICAL

Step 3: Dependency Audit

Check for known-vulnerable packages:

# Python
pip-audit 2>/dev/null || safety check 2>/dev/null || echo "No pip-audit/safety available"

# Node
npm audit --json 2>/dev/null || yarn audit --json 2>/dev/null || echo "No npm/yarn audit available"