fix(security): skip hidden directories in skill template discovery

[HMAKT99]

Summary

• discoverTemplates() in scripts/discover-skills.ts scans subdirectories for .tmpl files
• SKIP set only blocks node_modules, .git, dist
• Hidden directories (.claude/, .agents/, .codex/) were being scanned
• These contain symlinked skill installs — a malicious .tmpl in a symlinked skill directory would be discovered and processed by gen-skill-docs

Fix

- .filter(d => d.isDirectory() && !SKIP.has(d.name))
+ .filter(d => d.isDirectory() && !d.name.startsWith('.') && !SKIP.has(d.name))

Skips all dot-prefixed directories. All 28 legitimate skills still generate. All tests pass.

1 file, 1 line changed

scripts/discover-skills.ts

Test plan

• All existing tests pass (0 fail)
• 28 Claude skills still generate
• 27 Codex skills still generate
• .claude/, .agents/, .codex/ directories skipped

[garrytan]

Thanks @HMAKT99 — your fix is in main: scripts/discover-skills.ts:13 has the exact !d.name.startsWith('.') filter. Closing as superseded; sorry we didn't link your PR at merge time. Credit retained here.