Add safety scanner for skill submissions

[timctfl]

Summary

• Adds scripts/safety_scanner.py with rule-based checks (Python AST, JS/shell regex) and Claude Opus 4.6 LLM review
• Catches eval/exec, reverse shells, prompt injection, obfuscated payloads, privilege escalation, zero-width char hiding, and more
• Only scans skills changed in the PR to keep API costs low
• Gracefully skips LLM checks when ANTHROPIC_API_KEY is not set (fork PRs)
• Includes 32 unit tests and 8 test fixtures covering every rule category
• All 19 existing skills pass with zero BLOCK findings

Test plan

• All 32 unit tests pass (python scripts/test_safety_scanner.py)
• Integration smoke test: all 19 existing skills produce zero BLOCK findings
• Live LLM test: ran with real Opus API key, all 19 skills pass
• import os in product-attribute-dictionary produces WARN (not BLOCK)
• console-script.js (browser IIFE) produces zero findings
• After merge: add ANTHROPIC_API_KEY as repo secret (already done)

🤖 Generated with Claude Code