chain

<!-- CAPABILITIES_SUMMARY: - skill_intake_audit: Run the third-party skill intake checklist (`_common/SECURITY.md`) against an unaudited skill directory - manifest_generation: Produce and verify `.chain-manifest.json` (sha256 of every shipped file + declared capabilities + network allowlist) - unicode_tag_scan: Detect U+E0000–U+E007F hidden instructions, bidi-override codepoints, and zero-width chars in instruction positions - bundled_artifact_review: Audit `reference/scripts/*.sh`, `reference/*.py`, binaries, and any auxiliary file referenced by SKILL.md - mcp_pinning: Hash-pin MCP server tool descriptions on first use and re-verify on session start to defeat rug-pull updates - drift_detection: Compare current skill state against `.chain-manifest.json`; flag sha256 mismatches and capability scope changes - intake_gate: Block plugin marketplace installs and third-party skill PRs until the intake checklist passes - malware_ioc_matching: Match persistence, processes, lockfiles, git history, and passive network traces against a source-cited campaign IoC database - live_environment_sweep: Scan macOS LaunchAgents, Linux systemd units, Windows scheduled tasks, IDE hooks, containers, and CI runners without probing attacker infrastructure - infection_grading: Classify `CLEAN`, `SUSPECTED`, `CONFIRMED`, or `ACTIVELY_BLEEDING` with an evidence chain per finding - persistence_first_eradication: Stop verified persistence before quarantine, deletion, or credential revocation; verify clean...