hardening

This plugin provides twelve security-focused skills: six pre-launch gates (rate-limit-audit, exposure-scan, secrets-leak-audit, security-headers, readiness-review, auth-hardening) plus five design-time and agent-era checks (threat-model, webhook-reliability, privacy-audit, agent-tooling-review, llm-app-security) and a legal-docs drafter for customer-facing policies. Each skill audits a specific attack surface—from leaked credentials and compromised dependencies to missing OAuth scopes and unverified webhooks—with no exotic requirements, just deterministic checks of what actually ships.