Update to gstack Workflows

{
  "description": "Perform an evidence-backed security review using OWASP and STRIDE-oriented checks.",
  "included_files": [
    {
      "relative_path": "agents/openai.yaml",
      "size_in_bytes": 259
    }
  ],
  "name": "cso",
  "skill_md_contents": "---\nname: cso\ndescription: Perform an evidence-backed security review using OWASP and STRIDE-oriented checks.\n---\n\n# CSO\n\nPortable ChatGPT/Codex adaptation of the `cso` workflow from `garrytan/gstack`. Preserve the original job and safety intent while mapping execution to capabilities the current host actually exposes.\n\n## When to use\n\nUse this Skill when the user explicitly names `cso` or asks for the same job described above.\n\n## Host contract\n\n- Inspect repository or file evidence before making claims about the current state.\n- Use host-native read, list, search, grep, patch, write, shell, browser, computer, and Python capabilities only when they actually exist.\n- Never claim commands, tests, browser actions, device actions, file writes, Git operations, or external mutations that were not executed.\n- Prefer read-only discovery before mutation.\n- Respect repository instructions and preserve unrelated work.\n- When the original native gstack runtime is available in Codex, it may be used as an implementation detail after inspecting the installed upstream Skill. Do not hard-code Claude-only paths as a requirement.\n\n## Workflow\n\n1. Establish assets, trust boundaries, inputs, privileged actions, and likely attackers.\n2. Inspect the in-scope code and configuration for concrete weaknesses.\n3. Use OWASP and STRIDE as coverage aids, not as a checklist substitute for evidence.\n4. Validate exploitability and impact before assigning severity.\n5. Recommend specific remediations and verification steps.\n6. Do not change code unless the user separately requests remediation.\n\n## Completion\n\nReturn the decision, findings, changed artifacts if any, executed verification, skipped checks, and remaining blockers.\n"
}