feat: add skill-security-auditor as default example skill

[statxc]

Related Issue

Closes #1462

Description

Add skill-security-auditor as a default example skill that ships with Eigent. This gives all agents built-in security awareness for code auditing, secrets detection, and vulnerability scanning.

What's included:

• SKILL.md - Core audit guide with a 6-step workflow: reconnaissance, secrets detection, OWASP Top 10 vulnerability scanning, dependency audit, configuration review, and auth/authorization review. Includes a standardized report format.
• references/vulnerability-patterns.md - Detailed detection patterns for injection, auth, crypto, deserialization, SSRF, and file operation vulnerabilities across Python, JavaScript, TypeScript, Go, and Java. Includes framework-specific checks for Django, Flask, Express, and Spring Boot.
• references/secrets-patterns.md - Regex patterns for 20+ secret types (AWS, GCP, Azure, GitHub, Slack, Stripe, SendGrid, etc.), database connection strings, and private keys. Includes false-positive reduction rules.
• scripts/scan_project.py - Full project scanner that checks for hardcoded secrets, dangerous function calls (by language), and insecure configuration patterns. Supports text and JSON output.
• scripts/scan_secrets.py - Focused secrets scanner with false-positive filtering (skips placeholders, env var references, test files by default). Supports --include-tests flag.

No code changes required - the existing skill system auto-discovers new example skills from resources/example-skills/ via seedDefaultSkillsIfEmpty() and skills-scan. No modifications to Electron, frontend, backend, or build config.

Testing Evidence (REQUIRED)

• I have included human-verified testing evidence in this PR.
• This PR includes frontend/UI changes, and I attached screenshot(s) or screen recording(s).
• No frontend/UI changes in this PR.

Script verification:

$ python scripts/scan_project.py /path/to/project --format text
Scanned 6 files, found 24 issue(s)
  Critical: 9
  High: 10
  Medium: 5
  Low: 0

$ python scripts/scan_secrets.py /path/to/project --format text
Scanned 6 files, found 10 potential secret(s)

By type:
  RSA Private Key: 2
  Generic Private Key: 2
  ...

Both scripts run successfully with stdlib-only dependencies (no pip installs needed), produce correct output in both text and JSON formats, and return appropriate exit codes (0 for clean, 1 for findings).

Project Scan:

Secretes Scan:

What is the purpose of this pull request?

• Bug fix
• New Feature
• Documentation update
• Other

Contribution Guidelines Acknowledgement

• I have read and agree to the Eigent Contribution Guideline

[statxc]

@Wendong-Fan @bytecii Please review this PR.

[statxc]

@Wendong-Fan @fengju0213 @Pakchoioioi Please review my PR and give me any feedbacks

[statxc]

Please any updates for me

[4pmtong]

Thanks @statxc for contribution! could @fengju0213 @Pakchoioioi help review it?

[4pmtong]

Hi @statxc The copyright line is still the template placeholder [yyyy] [name of copyright owner]. Could you fill this in？

[4pmtong]

Hi @statxc Consider checking only the parts relative to the project root instead. Same issue exists in scan_secrets.py

[fengju0213]

thanks @statxc left some comments

[fengju0213]

we should also check env？

[fengju0213]

This might cause miss commented keys.

[statxc]

@4pmtong @fengju0213 Thanks for your feedbacks. Good points! I have fixed. I'd appreciate you review again.

[statxc]

Please review again. what else should I update more?