V3 Security Overhaul

Run npm update for @anthropic-ai/claude-code to version 2.0.31 or higher, then run npm audit at the high level. Replace SHA-256 password hashing with bcrypt at 12 rounds and generate credentials using crypto.randomBytes.

Import bcrypt and call bcrypt.hash with the password and 12 salt rounds instead of using crypto.createHash with SHA-256 and a hardcoded salt. This provides adaptive hashing resistant to brute-force attacks.

It uses Zod for schema-based input validation. The skill defines schemas for task IDs as UUIDs, content strings with maximum lengths, and enumerated agent types to reject malformed input.

Resolve the user-supplied path against an allowed prefix using path.resolve, then verify the resolved path still starts with the allowed prefix. Throw a security error if the check fails to block directory escape attempts.

execFile runs the target binary directly with an argument array and shell set to false, so user input is never interpreted by a shell. This prevents command injection attacks that are possible with exec string concatenation.

The overhaul targets a 90 out of 100 security score from npm audit and custom scans, 100 percent resolution of critical CVEs, and over 95 percent test coverage on security-critical code.