What stood out here was the decision to write each security skill once in vendor-neutral markdown and treat the five harnesses as adapters around it, rather than rewriting the workflow for every tool. That is the kind of choice that pays off when the tools change, which they do constantly. The air-gapped calibration is also a useful detail — 70B+ models for multi-step triage versus 8B to 14B for bounded single-file audits gives readers a concrete floor instead of a vague instruction to use a big model. And keeping human confirmation in front of every git mutation, even while aiming for autonomy, is the right priority for vulnerability work where confidentiality matters.