Supply-Chain Hardening

Installing or importing a dependency runs someone else's code with your privileges. Every control in this skill exists to change what that sentence permits: when the code runs, whether it runs at all, what it can do when it does, and how you find out it was hostile.

This is a content skill, not a tool: it owns the reasoning — which control, which layer, whether to allow an exception — while config files own the rules. It serves three situations: hardening a project, hardening a machine or global config, and an agent mid-task when a gate fires.

Principles