feat(security): implement mcp-scan security check for skills

Add security scanning integration using mcp-scan (Invariant Labs) to detect
prompt injection attacks, malware payloads, sensitive data handling issues,
and hard-coded secrets in skill definitions.

Changes:
- Add mcp_scan_checker.py wrapping mcp-scan with structured output
- Add security-scan.yml GitHub Actions workflow (PRs + pushes to main/develop)
- Add 'make security-scan' Makefile target
- Update .skills-validator-check/readme.md with security scanning docs

Closes #101

.github/workflows/security-scan.yml

@@ -0,0 +1,35 @@
+name: Security Scan
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+
+permissions:
+  contents: read
+
+jobs:
+  security-scan:
+    name: MCP-Scan Security Check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: 'pip'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Run MCP-Scan on all skills
+        run: |
+          echo "🔍 Running MCP-Scan security check on all skills..."
+          python .skills-validator-check/validators/mcp_scan_checker.py --all -v