dockerfile-auditlisted

# Dockerfile Audit Audit every Dockerfile a project ships against the container-labelling and build-time hardening contract, and produce a single severity-classified audit artifact. The default `audit` operation reports and recommends; the opt-in `apply` operation writes a Dockerfile only after explicit confirmation. Implements `spec/project/dockerfile-best-practices/` — the spec defines the mandatory OCI-label contract, the four mandatory non-label pillars, the advisory best practices with their hadolint rule IDs, and the CI-injection presence rule. This skill binds those rules to the on-disk procedure and owns policy, severity, the report, and the apply. ## German trigger phrases This skill also triggers on equivalent German-language requests, including: - "Dockerfile auditieren" / "Dockerfile-Best-Practices prüfen" - "OCI-Labels prüfen" / "Container-Labels sicherstellen" - "OCI-LABEL-Block einfügen" ## User-language policy Detect the user's language from their message and respond in it. The audit artifact uses English section headings (so downstream tooling can parse it reliably); prose around the report is localised. ## Inputs - **Repo root**: default is the current working directory. - **Operation**: `audit` (default, read-only) or `apply` (opt-in, writes). Never run `apply` without the caller explicitly asking for it. - **hadolint version pin**: per `spec/project/dockerfile-best-practices/` §Version and tool anchors, an audit MUST pin a specific hadolint versio