--- title: "Chief Security Officer Audit - Air Market" description: "Most security passes read the code and stop, missing the secrets in your history, what your dependencies pull in, and your build pipeline. This audits that wider ground and checks findings rather tha…" canonical: "https://airmarket.ai/app/cso" --- [Air Market](/) / [Security](/category/security) / Chief Security Officer Audit Skill by [CWing](/@gcwing) # Chief Security Officer Audit A security review that digs past the code into everything around it ## What this does Most security passes read the code and stop, missing the secrets in your history, what your dependencies pull in, and your build pipeline. This audits that wider ground and checks findings rather than just listing them. There is a quiet everyday pass and a deeper one for when you want the full sweep, and it tracks how things move between runs. ### Top 3 things it does for you - Audit the project for security problems - Hunt for leaked secrets and their history - Check what your dependencies drag in ## Information **Chief Security Officer Audit at a glance** | | | | --- | --- | | Kind | Skill | | Publisher | [CWing](/@gcwing) | | Category | [Security](/category/security) | | Works with | Agent Skills - an open standard supported by 40+ agents | | Size | 38 KB | | Licence | MIT | | Repository | [GCWing/BitFun](https://github.com/GCWing/BitFun/tree/1ec22139cd2bf3b10ad41f1a825c4c7a76618bac/src/crates/assembly/core/builtin_skills/gstack-cso) | | GitHub stars | 1,811 (as of Nov 2026) | ## Security report **Verified.** AIR scanned this exact version of Chief Security Officer Audit and flagged nothing. AIR's verdict: **safe**. **What Chief Security Officer Audit's check was run against** | | | | --- | --- | | Commit | 1ec22139cd2bf3b10ad41f1a825c4c7a76618bac | | Content hash | ae1c4b11dd9a1266bab5b9e62d0ed9bb66576fcde2da7c41439a1c2177cab22f | | Files read | [Browse the files at this exact commit](https://github.com/GCWing/BitFun/blob/1ec22139cd2bf3b10ad41f1a825c4c7a76618bac/src/crates/assembly/core/builtin_skills/gstack-cso/SKILL.md) | A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned. [Read the full security report for Chief Security Officer Audit](/security/cso) ## About Chief Security Officer Audit This is a Chief Security Officer mode: an infrastructure-first security audit covering secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM and AI security, and skill supply chain scanning, alongside OWASP Top Ten, STRIDE threat modeling and active verification. It runs in two modes. A daily mode aims for zero noise behind a high confidence gate; a comprehensive mode is a deeper periodic scan with a much lower bar for what it reports. Results are tracked as trends across audit runs. Reach for it on a security audit, a threat model, a pentest review, an OWASP pass or a CSO review. It also answers to spoken aliases such as security review, security check, vulnerability scan and run security. ## What's inside - SKILL.md - instructions ## Questions ### Is Chief Security Officer Audit safe to install? AIR scanned this exact version of Chief Security Officer Audit and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit 1ec22139cd2b, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/cso. ### How do I install Chief Security Officer Audit? Open https://airmarket.ai/app/cso on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/GCWing/BitFun/tree/1ec22139cd2bf3b10ad41f1a825c4c7a76618bac/src/crates/assembly/core/builtin_skills/gstack-cso. Install from that link, not the branch. ## Related on Air Market - [More Security listings](/category/security) - [Everything by CWing](/@gcwing) --- Canonical URL: