{"id":18518,"plugin_id":"plugins_6a8936fa5798819182ef2a60f1c08a71","kind":"skill","collection_source":null,"comparison_source":null,"observed_at":"2026-09-30T23:14:50.870Z","digest":"10ebcd7e74ed192dbd462480a549b9e08e64811ef2bd2e92876bec7e7720727c","against":null,"payload":{"description":"Perform an evidence-backed security review using OWASP and STRIDE-oriented checks.","included_files":[{"relative_path":"agents/openai.yaml","size_in_bytes":259}],"name":"cso","skill_md_contents":"---\nname: cso\ndescription: Perform an evidence-backed security review using OWASP and STRIDE-oriented checks.\n---\n\n# CSO\n\nPortable ChatGPT/Codex adaptation of the `cso` workflow from `garrytan/gstack`. Preserve the original job and safety intent while mapping execution to capabilities the current host actually exposes.\n\n## When to use\n\nUse this Skill when the user explicitly names `cso` or asks for the same job described above.\n\n## Host contract\n\n- Inspect repository or file evidence before making claims about the current state.\n- Use host-native read, list, search, grep, patch, write, shell, browser, computer, and Python capabilities only when they actually exist.\n- Never claim commands, tests, browser actions, device actions, file writes, Git operations, or external mutations that were not executed.\n- Prefer read-only discovery before mutation.\n- Respect repository instructions and preserve unrelated work.\n- When the original native gstack runtime is available in Codex, it may be used as an implementation detail after inspecting the installed upstream Skill. Do not hard-code Claude-only paths as a requirement.\n\n## Workflow\n\n1. Establish assets, trust boundaries, inputs, privileged actions, and likely attackers.\n2. Inspect the in-scope code and configuration for concrete weaknesses.\n3. Use OWASP and STRIDE as coverage aids, not as a checklist substitute for evidence.\n4. Validate exploitability and impact before assigning severity.\n5. Recommend specific remediations and verification steps.\n6. Do not change code unless the user separately requests remediation.\n\n## Completion\n\nReturn the decision, findings, changed artifacts if any, executed verification, skipped checks, and remaining blockers.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}