Add Skill Inspector companion skill

[Dxboy266]

Summary

Adds skills/skill-inspector/SKILL.md, a companion Agent Skill that uses SkillSpector as the static evidence layer before an agent performs source-aware semantic review.

The skill workflow:

• runs skillspector scan --no-llm --format json
• reads the target skill's SKILL.md, executable scripts, MCP config/tool metadata, and finding locations
• combines static findings with source context into APPROVE / CAUTION / REJECT

Why

SkillSpector scores and findings are strong evidence, but some sensitive capabilities are expected for certain skills. This companion skill gives agent runtimes a repeatable install-before-review workflow that does not require configuring an LLM provider inside SkillSpector.

Files

• skills/skill-inspector/SKILL.md

Verification

Validated the PR shape with only SKILL.md present:

tmpdir=$(mktemp -d)
cp SKILL.md "$tmpdir/SKILL.md"
skillspector scan "$tmpdir" --no-llm --format json --output /tmp/skill-inspector-pr-shape.json

Result: 0 / LOW / SAFE, no issues.

[rng1995]

[Automated SkillSpector Review]

Approved. The companion skill keeps the target untrusted, runs deterministic analysis first, prohibits executing target scripts or silently installing dependencies, and requires source-aware review of sensitive findings before an APPROVE/CAUTION/REJECT verdict. The docs-only change is coherent and its manual scan shape is appropriate.

Non-blocking: use a per-run mktemp report path instead of the predictable shared /tmp/skill-inspector-report.json.

[rng1995]

Fix the CI issue @Dxboy266