Summary

• add package script checks for curl-to-shell, destructive commands, unpinned npx, and environment dumps
• add GitHub Actions checks for pull_request_target, write-all permissions, missing refs, and floating refs
• add Python dependency checks for URL sources and legacy install hooks
• document supply-chain coverage and add optional MISP enrichment to the roadmap

Verification

• .venv/bin/python -m pytest tests/test_security_cmd.py -q
• .venv/bin/python -m pytest -q
• git diff --check
• PYTHONPATH=$HOME/repos/content-guard/src python3 -m content_guard scan . --policy $HOME/repos/content-guard/policies/public-repo.json
• rg -n "AgentShield|AgentShield-style|agentshield|affaan" .
• live brigade security scan smoke against a temporary supply-chain sample workspace