cso
An agent skill by garrytan, from garrytan/gstack. Tags: audit, security, static-analysis, validation.
What it does
Security audit: supported static findings; qualified profiles add reproduction and repair candidates. (gstack)
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add garrytan/gstack --skill csoOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/cso ~/.claude/skills/csoSafety box score
Grade D, elevated risk: 46 of 100 risk points, rated 2026-10-06. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is a security-audit orchestrator that runs a local gstack launcher, reads repository source/history, and can optionally drive isolated reproduction and verification flows. The main risks are broad read access to secrets and history, external network lookups for advisories/model transport, and writing state/control files outside the repo under the user’s home directory; it does not request sudo or global installs.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It authorizes a local shell launcher (`Bash(~/.claude/skills/gstack/bin/gstack-cso-launcher *)`) and exposes helper commands that can run audit/reproduction workflows, so it can execute code via the trusted local binary. |
| Network access | 2 (moderate) | The skill permits advisory and helper lookups by default (`Query only public package/advisory IDs`, `host controls model transport`) and only blocks them with `--offline`, so data can leave the host. |
| Filesystem reach | 2 (moderate) | It uses paths under `~/.claude/skills/gstack/...` and requires `a mode-0700 directory outside the audited repository` plus `mode-0600 JSON`, so it writes outside the project tree. |
| Secrets & credentials | 2 (moderate) | Phase 2 explicitly looks for `committed credentials`, `sensitive URL userinfo`, `CI inline secrets`, and other secret-bearing material in tracked source and Git history. |
| Privilege & persistence | 0 (none) | There is no sudo, service registration, global installation, or shell/OS setting change in the skill text. |
| Instruction hijack surface | 2 (moderate) | It strongly scripts agent behavior, including `Skip shared startup, learning, checkpoint and telemetry` and `Do not send findings, source, secrets, harnesses, or bundles to gbrain, telemetry, review ledgers, or shared learning`. |
| Irreversible actions | 1 (low) | It can independently submit findings, resume/replay runs, and generate repair/reproduction artifacts, but it does not deploy, publish, or modify external systems. |
| Transparency | 0 (none) | The shipped files are plain markdown/JSON; no binaries, base64 blobs, or decoded-at-runtime code appear in the skill package. |
Before installing
- Verify `~/.claude/skills/gstack/bin/gstack-cso-launcher` is the trusted binary you expect, not a symlink or replacement.
- Decide whether the skill may read Git history and secret-bearing files; use a scratch clone if you want to avoid that.
- If you do not want helper state/control files under `~/.claude/...`, do not install this skill.
- Run with `--offline` first if you want to prevent advisory/model-network lookups.
Rated 2026-10-06 by an automated review of 4 files from the skill's repository.
Source
- Repository
- garrytan/gstack (all skills from this repository)
- Path
- cso/SKILL.md
- Branch
- main
- Updated
- 2026-10-05
Related skills
- marketplace-health-check — Run a full 6-dimension health check of this Claude Code skills marketplace repo — code/script safety, documentation/SSOT consistency, security/PII leaks.
- agents-harden — Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle.
- agents-pay — Use when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments.
- aws-cloudformation — Authors, validates, and troubleshoots AWS CloudFormation templates.
- aws-iam — Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits.
- aws-security — Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries.