claude-moat

Refresh the supply-chain pins that already exist in a repo — bump pinned GitHub Action SHAs to newer releases via pinact, re-resolve Docker image digest pins (Dockerfile, docker-compose and Swarm stack files, .gitlab-ci.yml, workflow services) to the tag's current digest, refresh the dated pin comments, and finish with a report-only docker scout CVE pass over the pinned images. Use whenever the user wants to update, bump, or refresh existing pins — "bump the node pin", "the security patch landed, update the pin", "refresh the digests", "update the pinned actions", "are our pins stale?", mentions pinact, or a security advisory lands for a pinned image or action. Creating *new* pins in an unhardened repo belongs to the sibling moat-repo-fixer skill; this skill keeps already-pinned repos current.

Apply in-repo security hardening fixes that Laravel's `moat` CLI flags for the current repository — pin GitHub Actions to commit SHAs, add a Dependabot config tailored to the repo's ecosystems, drop in a `SECURITY.md`, and restrict per-workflow token permissions. Also applies proactive supply-chain hardening beyond moat's own findings, tailored per ecosystem — npm/Bun install-script and release-age cooldowns, Composer `allow-plugins`, Python (pip/uv) wheels-only installs and hash-pinning, Go checksum and `govulncheck` checks, plus pinning Docker image tags to digests and catching stale pinned versions across Dockerfiles, compose/Swarm stack files and CI config. Use when the user is inside a repo and wants to action moat findings, or asks to "harden this repo", "fix moat issues here", "apply moat fixes", "harden npm/composer/python/go/bun", or "protect against supply-chain attacks". Can optionally deliver the applied fixes as a GitLab merge request via `glab` when the repo's primary remote is an on-prem/self-m

Apply settings-level security hardening fixes that Laravel's `moat` CLI flags at the org or repo-settings level — org-wide workflow token defaults, secret scanning / push protection / dependabot defaults, branch protection or repository rulesets, per-repo workflow permissions, direct collaborator cleanup. Use when the user has a moat report (or wants to run one) covering an organization and wants to action the settings findings. Prefers `gh api` over Chrome automation for safety and auditability; falls back to chrome-devtools-mcp for UI-only items. File-level fixes inside individual repos belong to the sibling `moat-repo-fixer` skill.