Teach Claude Code a security-response skill with live-write guards

Babker's spark: on the PHP multipart RCE response (CVE-2026-109618 / 109619), Claude Code helped — except "at one point a session changed a live edge security policy without asking first." Nothing broke; he still treated an unsupervised production write as a second incident. The skill's center is that rule: agents may read everything; they may not change live systems without a per-step human approval.

His skill directory holds SKILL.md, an estate inventory, four briefs (exposure mapper, mitigation engineer, patch builder, rollout planner), a report template, and a guard hook. The main session orchestrates only: it does not investigate itself; it hands work out, merges results, holds approvals, and owns commits. Exact file contents are unpublished — recreate the shape from his description.

Every run: orchestrator gets an ID and a workspace in his home directory, deliberately outside every repository, because a map of exposures does not belong in VCS. It reads the advisory once and writes one advisory.md (affected/fixed versions, vector, upstream commits, vendor mitigations, confidence). Four agents must not work from four slightly different readings.

His dispatch prompt is intentionally short — it points at files instead of retyping them:

Inventory is a baseline, not truth. The skill sweeps the GitHub org's non-archived repos with gh search code over lockfiles, Dockerfiles, and CMS version files. Unplaced hits get hosting inferred from deploy workflows / vercel.json / Railway config — or marked "hosting unknown", never dropped. Every claim is labeled Verified (command + output saved), Read (cited file/page), or Assumed (with why). A target whose exposure is all assumed is reported unknown, not safe.

Mitigation engineer derives candidates from the upstream fix, proves each in a throwaway container (vulnerable reproduces → mitigation blocks → business traffic still works), and keeps a "Doesn't help" section. After two agents froze his ARM Mac under unbounded x86 builds (~960% CPU), shared briefs now cap CPU/memory, fix -j3, one build at a time, prefer ARM images. Live rule: nothing changes staging/production/policy/registry/remote branch until he approves that exact step. Backstop: global PreToolUse hook running live-guard.py that returns ask on kubectl apply, gcloud … update, ssh, git push, registry push, Railway deploy, non-localhost HTTP writes — never deny, biased to ask. Skill frontmatter registration failed inside subagents; he moved it to global settings and confirmed with a harmless matching command.