Summary

• add a built-in security station and read-only agent workspace scanner
• cover initial rules for secrets, permissions, automation hooks, MCP patterns, supply-chain patterns, and prompt-injection style instructions
• add optional routing of findings into the local work import inbox
• document the cybersecurity plugin roadmap without public references to external comparison projects

Verification

• .venv/bin/python -m pytest tests/test_security_cmd.py tests/test_registry.py tests/test_status.py -q
• .venv/bin/python -m pytest -q
• PYTHONPATH=$HOME/repos/content-guard/src python3 -m content_guard scan . --policy $HOME/repos/content-guard/policies/public-repo.json
• git diff --check
• .venv/bin/brigade security scan --target "$tmpdir" --fail-on critical
• .venv/bin/brigade security scan --target "$tmpdir" --fail-on none --import-findings
• .venv/bin/brigade work import triage --target "$tmpdir" --limit 5