cso
garrytan/gstack / cso
searches code for exploitable flaws , which improves: avoids vulnerabilities before they reach production
Details
- judge’s score
- 6/10
- place
- outside the packs
- publisher
- garrytan
- status
- new
- pinned commit
- c580561 on GitHub (new tab)
- skill’s last commit
- Oct 19, 2026
- repo stars
- 137,030
- main type
- Building with Claude
Judgement
Clear scope (security audit) and readable trigger, but the skill depends on a missing helper and a heavy workflow that cannot be verified. Truncated phase appendix, marketing vocabulary. Few testable rules.
reservations
- The gstack-cso helper and its contracts (lib/cso/contracts.ts) are not provided: the commands described cannot be verified.
- The sections/audit-phases.md appendix is truncated (5,000 of 15,501 characters): phases 2 to 11 cannot be assessed.
- The file is very dense and largely procedural (one-run invariant, budgets, assurance labels); few concrete instructions for Claude itself.
- Triggering
- 1/2
- Added value
- 1/2
- Precision
- 1/2
- Scope
- 2/2
- Quality
- 1/2
Alerts
2 alerts, by category
Network
- high risk
Public lookup requests (OSV, advisories) disclose package names and versions to a third party; the skill specifies no safeguard beyond --offline.
Static scan
- info risk
allowed-tools frontmatter
"Bash(~/.claude/skills/gstack/bin/gstack-cso-launcher *)" - "Bash(~/.claude/skil
Original description
Security audit: supported static findings; qualified profiles add reproduction and repair candidates. (gstack)
added on Oct 19, 2026 · license MIT