feat: add read-only Agent Guild trust skill

[AgentTanuki]

Submit a Skill

Thank you for contributing a skill to the Goose community!

📛 Skill Info

• Skill name (folder name): agent-guild-trust
• Short description: Gives Goose a read-only evidence check before recommending an unfamiliar autonomous agent, plus signed-passport verification.
• Author / handle: AgentTanuki
• Version: 1.0

📁 Structure Checklist

• My skill is in a top-level folder (agent-guild-trust/)
• The folder contains a SKILL.md file
• SKILL.md includes valid YAML frontmatter:
  • name
  • description
  • author
  • version
  • tags (list of strings)
• Supporting files live inside the skill folder (none are required)

🔐 Security Acknowledgement

• This skill does not contain malicious behavior
• This skill does not attempt to exfiltrate secrets, tokens, or credentials
• This skill does not contain obfuscated payloads
• I understand that all submissions run through automated security scanning
• I understand this PR may be rejected if it fails validation or security review

📝 Additional Notes

The skill is intentionally least-privilege: it forbids automatic delegation, payments, registration, writes, dependency installation, and execution of remote content. Remote response fields are treated as untrusted data. It uses only the host's existing HTTP or MCP client.

Local validation:

• node scripts/validate-skills.mjs - passed
• security scan - no failures; four expected network:url review warnings for the exact documented Agent Guild HTTPS endpoints
• one new Markdown file, no scripts, binaries, or dependencies