Add attack taxonomy integration with security check categories

[thebenignhacker]

Summary

• Add MITRE ATT&CK-inspired attack taxonomy classification to security checks
• Map all 147 security checks to taxonomy categories (prompt injection, data exfiltration, tool misuse, etc.)
• Add new scanner checks for supply chain, dependency confusion, and build pipeline risks
• Update security check documentation with taxonomy classifications

Test plan

• Verify npm run build compiles without errors
• Verify npm test passes all 915+ tests
• Verify npx hackmyagent secure --ci includes taxonomy class in findings

[github-actions]

Claude Code Review

VERDICT: APPROVE

SUMMARY: This PR adds attack taxonomy classification to security findings, mapping 147+ security checks to MITRE ATT&CK-inspired categories (prompt injection, data exfiltration, supply chain, etc.). The implementation adds 16 new security checks across 5 new categories (memory poisoning, RAG poisoning, agent identity spoofing, agent DNA forgery, skill memory manipulation) and enriches all findings with taxonomy metadata. The code is purely additive, introduces no security regressions, and follows defensive patterns (safe JSON parsing with try/catch, path traversal prevention via path.relative, bounded directory walking with depth limits).

No CRITICAL or HIGH findings after verification.

FINDINGS:

• [MEDIUM] src/hardening/scanner.ts:6182 — Directory walk helper uses maxDepth=10 default which could traverse deeply nested malicious directory structures. However, this is mitigated by (a) skipDirs filtering common exploit targets and (b) caller-side slicing of results (.slice(0, 50) at lines 6321, 6521, 6563), so the actual risk is bounded. Not blocking.

---

Reviewed 5 files changed (41578 bytes)