Add agent skill trust check

[TateLyman]

Submit a Skill\n\n### Skill Info\n\n- Skill name (folder name): agent-skill-trust-check\n- Short description: Pre-install trust review checklist for third-party agent skills and SKILL.md packages.\n- Author / handle: TateLyman\n- Version: 1.0\n\n### Structure Checklist\n\n- [x] My skill is in a top-level folder.\n- [x] The folder contains a SKILL.md file.\n- [x] SKILL.md includes valid YAML frontmatter: name, description, author, version, and tags.\n- [x] Supporting files live inside the skill folder. This submission has no supporting files.\n\n### Security Acknowledgement\n\n- [x] This skill does not contain malicious behavior.\n- [x] This skill does not attempt to exfiltrate secrets, tokens, or credentials.\n- [x] This skill does not contain obfuscated payloads.\n- [x] I understand that all submissions run through automated security scanning.\n- [x] I understand this PR may be rejected if it fails validation or security review.\n\n### Additional Notes\n\nThis is a text-only static review workflow for checking skills before install. Local validation passed with node scripts/validate-skills.mjs. The local security scanner wrote a PASS report with 0 warnings and 0 failures; the script then exits on an existing trailing sks token in the base repo scanner, so I am noting the generated report status here.

[github-actions]

✅ Validate Skills — PASSED

Summary: FAIL=0 · WARN=0
Changed skill dirs: agent-skill-trust-check

Output (last 200 lines)

✅ Found 8 skill directories.
✅ agent-skill-trust-check: structure validated
✅ api-setup: structure validated
✅ beads: structure validated
✅ code-review: structure validated
✅ frontend-design: structure validated
✅ goose-blog-post: structure validated
✅ rp-why: structure validated
✅ testing-strategy: structure validated

Structure validation PASSED.

[github-actions]

🛡️ Skills Security Scan — PASS

Summary: FAIL=0 · WARN=0 · FILES=1
Changed skills scanned: agent-skill-trust-check

✅ No issues detected.

---

Notes: This comment auto-updates on each push to keep PRs clean.