Add a security rule for creating agent skills

[thomas-bartlett]

Summary

Add a model-agnostic CodeGuard rule for securely creating and modifying agent skills.

Skills can control tools, files, networks, credentials, and agent behavior, so they should be treated as security-sensitive artifacts.

Related discussion: #43

Proposed guidance

The rule should cover:

• Using only necessary tools and permissions.
• Making filesystem, network, shell, and credential access explicit.
• Avoiding hidden instructions and unsafe commands.
• Documenting the skill's purpose, inputs, outputs, and dependencies.
• Reviewing skills before publishing or installing them.

Acceptance criteria

• A new source rule is added.
• Relevant examples are included.
• Validation and existing tests pass.
• Generated formats and documentation are updated as needed.

[AdvaitVarhade]

I would like to work on this. I can implement the new security rule in Python to analyze skill definitions for tool permissions, unsafe shell commands, and hidden instructions, along with complete test cases and documentation updates.