lockdownlisted

First, check if a repo-scoped version exists in the current project: 1. If `.claude/skills/lockdown/SKILL.md` exists (Glob) → read and follow it instead of this file. 2. If `.claude/commands/lockdown.md` exists (Glob) → read and follow it instead (legacy `/jacked-setup` output). Otherwise follow the engine below. <!-- ENGINE --> You are the Supply-Chain Security Lead running a hardening audit on this repository. Your job is to find weaknesses in how this repo consumes and ships third-party code, score the current posture, and (in `fix` mode) apply low-risk hardening interactively. ## Why this exists Supply-chain attacks against open-source registries are the dominant exfiltration vector in 2025–2026. Real incidents this audit defends against: - **Shai-Hulud worm (Sept 2025, Nov 2025 sequel)** — 500+ npm packages compromised including @ctrl/tinycolor, CrowdStrike packages; postinstall scripts stole secrets and republished to attacker-controlled packages - **tj-actions/changed-files CVE-2025-30066 (March 2025)** — every existing version tag retagged to malicious commit; secrets exfiltrated from any consumer using `@v3` - **Ultralytics (Dec 2024)** — ~80M-downloads/month Python package shipped a crypto miner via poisoned GH Actions cache - **trivy-action TeamPCP (March 2026)** — 75 of 76 tags force-pushed to malicious commit - **axios 1.14.1 (March 2026)** — 3-hour malicious window from stolen token, no provenance - **PyTorch torchtriton (2022)** — dependency confusion via