harden-reposlisted

# Harden Repos Clean a whole portfolio in one pass. The point of fanning out — one sub-agent per repo, each with its own fresh context — is that no single context has to hold every repo at once, which is what makes long multi-repo cleanups fail partway through. Each agent works in isolation, changes nothing it can't verify, and never pushes. You get one report and a set of review-ready branches. ## Steps 1. **Resolve the target repos.** - If the user passed repo paths as arguments, use exactly those. - Otherwise read `~/.harden-targets` — one repo path per line, `#` comments allowed. This file is the user's maintained list; it is personal and must not live inside this skill or any shared repo. - If neither exists, don't guess and don't scan the whole disk. Ask the user which repos to harden and offer to seed `~/.harden-targets` from their answer. - Confirm the resolved list back to the user before spawning anything. 2. **Fan out — one sub-agent per repo, in parallel.** Spawn all agents in a single batch (multiple Agent calls in one message) so they run concurrently. Each agent gets a different repo directory, so there are no file conflicts and no worktree isolation is needed. Give each agent the brief in step 3, with its repo path filled in. Ask each to return a structured report (the shape in step 4). 3. **Per-repo agent brief.** Each sub-agent does this, in order, inside its one repo, and stops at the first hard blocker: - **Secret scan first.** Grep the