Add Trojan Skill Hunter agent for auditing AI customization contributions 🤖🤖🤖

[sjiyani]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services (not applicable - no paid services involved).
• My contribution adds a new instruction, prompt, agent, skill, or workflow file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, or workflow with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Adds Trojan Skill Hunter, an agent that audits AI agent/skill/instruction/hook/MCP-config contributions for hidden prompt injection and supply-chain risks before they are merged, installed, or trusted.

This repo's agents/, skills/, instructions/, and hooks/ files get loaded directly into another developer's Copilot context, which makes them a real supply-chain trust boundary. I reviewed the existing security-focused agents and skills in this repo (agent-owasp-compliance, agent-supply-chain, mcp-security-audit, threat-model-analyst, security-review, se-security-reviewer, sast-sca-security-analyzer, etc.) and found they all audit application code or configuration - none of them audit the markdown customization content itself for hidden instructions aimed at the AI reader rather than the human reviewer.

Trojan Skill Hunter fills that gap. It checks for:

• Hidden directive injection (HTML comments, <IMPORTANT>-style tags invisible in a rendered preview)
• Unicode steganography (zero-width characters, bidi/RLO overrides, homoglyphs)
• MCP-style tool poisoning and tool shadowing (per Invariant Labs' Tool Poisoning Attack research)
• Excessive-agency scope mismatches (stated purpose vs. requested tools/permissions)
• Rug-pull/supply-chain drift (unpinned remote script refs, self-updating instructions)
• Encoded payloads (Base64/hex/ROT13 blobs that decode to instructions)

Findings are mapped to the OWASP Top 10 for LLM Applications (2025) and produced as a structured Markdown report with a PASS/FAIL/NEEDS-HUMAN-REVIEW verdict - it never auto-merges, auto-executes, or auto-rejects. It also has an explicit "Rule Zero": it treats everything it scans as untrusted data to analyze, never instructions to obey, so it can't itself be hijacked by the payloads it's hunting for.

---

Type of Contribution

• New agent file.

---

Additional Notes

Validated locally before opening this PR:

• npm ci && npm run build on a fresh branch cut from up-to-date origin/main - clean run, only docs/README.agents.md regenerated plus the new agent file
• eng/fix-line-endings.sh run, no stray diffs
• Searched the full agents/ and skills/ directories for name collisions and overlapping scope - confirmed no duplicate
• Content grounded in OWASP Top 10 for LLM Applications 2025 and Invariant Labs' MCP Tool Poisoning Attack research

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🔒 PR Risk Scan Results

Scanned 2 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	0

✅ No matching risk patterns were detected in changed files.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🔍 Vally Lint Results

⚠️ Warnings or advisories found

Scope	Checked
Skills	0
Agents	1
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	1

Summary

Level	Finding
ℹ️	Vally currently lints SKILL.md content. Agent files were detected but skipped:

Full linter output

### Agent files detected (not linted by vally)
ℹ️ Vally currently lints SKILL.md content. Agent files were detected but skipped:
agents/trojan-skill-hunter.agent.md