HAL

Review a PR, diff, or third-party/plugin code through the capability-security lens — inventory what authority the code reaches for and flag anything its stated purpose doesn't require. Use when reviewing pull requests, auditing contributed/untrusted code, or when asked "is this code safe/secure?"