oc-security-hardening

原文涵盖的主题

• Security Hardening
• Command Reference
• The manifest: .opchain/hardening.yaml
• /oc-harden baseline
• /oc-harden fix
• /oc-harden csp — staged rollout
• /oc-harden gate
• /oc-harden verify

On first invocation, read references/orchestrator.md and follow its welcome protocol. The execution half of opchain's security pair. oc-security-auditor answers "where are we exposed?" — STRIDE, OWASP mapping, posture scores. This skill answers "then close it, and prove it stays closed": it turns findings into merged config and code, records every applied control in a manifest, and wires the gate that re-verifies the manifest before every deploy. The verb pair, so nobody trips on it: /oc-hardening (auditor) audits the hardening posture. /oc-harden (this skill) does the hardening. Not an offensive tool: this skill never runs exploits, scanners, or penetration tests against any target, its own included — verification is limited to reading the repo's config, running the project's own test suite, and fetching response headers from the project's own deploy targets. External pen-test reports are consumed as findings to fix, never reproduced. Every control this skill applies is recorded with how it verifies (format: references/hardening-manifest.md): The manifest is the skill's spine: fix/baseline/csp append to it, verify replays it, gate enforces it. A control not in the manifest does no

这里只展示节选，请以完整原文和当前要求为准。