feat: add security hardening skill for agent frameworks

Description

Proposal: Add new skill for security hardening of agent frameworks

As agent frameworks (openclaw, gptme, zeroclaw, etc.) handle untrusted input and sensitive data, a dedicated security hardening skill would be valuable.

Skill contents

Name: agent-security-hardening

Description: Security best practices for AI agent frameworks - input validation, path traversal prevention, temp file permissions, credential handling, etc.

Sections:

1. Input validation

   • Validate IDs (thread_id, session_id) with allowlist regex ^[a-zA-Z0-9_-]{1,64}$
   • Reject empty/whitespace env vars
   • Validate URLs (scheme allowlist, no embedded creds, host presence)

2. Path traversal prevention

   • Never join user-controlled filename directly
   • Use Path.resolve().is_relative_to(workspace) check
   • Reject absolute paths and ..

3. Temp file security

   • Use 0o600 for sensitive files
   • Cleanup with try/finally
   • Avoid /tmp for highly sensitive data, use user-specific dir

4. Credential handling

   • Never log API keys
   • Use env vars or secure storage, not hardcoded
   • Zeroize after use where possible

5. Tool output sanitization

   • Limit output size
   • Sanitize control characters

Why

• Common vulnerability pattern across agent frameworks
• Would help contributors catch issues early
• Aligns with ECC's goal of best practices

Example structure

skills/agent-security-hardening/
  SKILL.md

I can PR this skill with detailed examples from real CVEs and fixes.

Checklist

• Searched existing skills
• No duplicate
• Follows skill template