feat: package SkillSpector as a Codex skill

[edjshen]

What changed

• packages SkillSpector as a reusable Codex skill-scanner skill
• adds the skill contract in SKILL.md, OpenAI UI metadata, and a portable launcher
• runs the repository's locked production environment through uv --frozen --no-dev
• defaults guidance to static --no-llm inspection and preserves scanner exit codes

Why

This makes the existing SkillSpector engine directly usable as an agent skill while keeping target skills untrusted and avoiding execution of their scripts or dependencies.

Validation

• skill-creator quick_validate.py: valid
• launcher --help: successful against SkillSpector 2.9.4
• safe fixture: exit 0, score 0, SAFE, 0 findings
• malicious fixture: exit 1, score 93, CRITICAL / DO_NOT_INSTALL, 6 findings
• branch reconciled cleanly with upstream main at SkillSpector 2.9.4

Static --no-llm mode intentionally reports disabled semantic analyzers as a limitation; the launcher does not hide that completeness signal.

[rng1995]

I would prefer to have it as SkillSpector itself.

[rng1995]

We should have it SkillSpector itself IMHO. The description anyways highlights it as a skill scanner

[rng1995]

@edjshen - Please address the review comments.

[rng1995]

Requesting changes for the recursive workflow bug below. The existing metadata naming threads also remain unresolved (display name, skill name), and the current head still fails the DCO check.

[rng1995]

[P2] Make the recursive workflow produce the JSON that step 4 requires. Adding --recursive to the canonical command without --output does not emit combined JSON: _scan_multi_skill prints human summaries unless an output path is supplied. An agent following these instructions therefore has no execution_successful/completeness fields to inspect. Require --output <path> for recursive scans and instruct the agent to read that file, or change the launcher to honor --format json on stdout.