From Skill.md to Shell: A Security Audit Guide for AI Agent Skills · HackerTrans