Harden skill docs for Snyk/Socket audit findings

[udit19199]

Summary

• Fixes Snyk-flagged security policy issues by removing unsafe external repo auto-clone guidance and adding explicit untrusted-repo handling in SKILL.md.
• Replaces risky verbatim snippet language with logic-fidelity guidance plus mandatory secret redaction rules.
• Adds README security posture notes and normalizes markdown punctuation/symbols to ASCII to reduce Socket obfuscation false positives.

Why

• Snyk reported W007 (secret exfiltration risk), W011 (third-party content exposure), and W012 (unverifiable external dependency/control via runtime external repo content).
• Socket flagged README as an obfuscated file; this appears to be a false positive, but documentation now includes clearer security posture and scanner-friendly text formatting.

Changes

• Updated SKILL.md to:
  • treat GitHub URLs as untrusted input,
  • require local trusted checkout paths,
  • prohibit executing analyzed repo code,
  • require secret redaction in snippets,
  • add a dedicated "Secret Leakage in Snippets" gotcha section.
• Updated README.md to:
  • document faithful-but-safe snippet policy,
  • document untrusted repository handling,
  • add a dedicated security note,
  • use ASCII punctuation/symbols consistently.

Validation

• Manual review of both audits and corresponding policy language updates.
• Verified SKILL.md contains no non-ASCII characters after normalization.

[Copilot]

Pull request overview

Updates the skill and repository docs to address Snyk/Socket audit concerns by hardening guidance around untrusted repositories and preventing secret leakage in generated course snippets.

Changes:

• Removed/rewrote guidance that implied auto-cloning external GitHub repos; added an explicit “treat external repos as untrusted” workflow in SKILL.md.
• Replaced “verbatim snippet” guidance with “logic-faithful but redact secrets” rules and added a dedicated snippet secret-leak gotcha section.
• Added README security posture notes and attempted ASCII normalization for scanner-friendliness.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
SKILL.md	Adds untrusted-repo handling guidance; adds snippet secret redaction rules; normalizes several symbols to ASCII.
README.md	Adds a security note and clarifies faithful-but-safe snippet policy; updates wording/symbols for scanner-friendliness.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This sentence uses code<->English without spaces around <->, which is inconsistent with other occurrences (Code <-> English) and hurts readability. Please normalize the spacing (or choose a consistent ASCII alternative) across all mentions.

[Copilot]

code<->English translations here omits spaces around <->, unlike other parts of the file/README. Normalizing to code <-> English (or similar) would keep terminology consistent and more readable.

Suggested change

	- **`references/interactive-elements.md`** - Implementation patterns for every interactive element: drag-and-drop quizzes, multiple-choice quizzes, code<->English translations, group chat animations, message flow visualizations, architecture diagrams, pattern cards, callout boxes. Read this before building any interactive elements.
	- **`references/interactive-elements.md`** - Implementation patterns for every interactive element: drag-and-drop quizzes, multiple-choice quizzes, code <-> English translations, group chat animations, message flow visualizations, architecture diagrams, pattern cards, callout boxes. Read this before building any interactive elements.

[Copilot]

In this phrase, code<->English is missing spaces around <->, which is inconsistent with the nearby heading text (Code <-> English ...) and reduces readability. Consider using code <-> English (with spaces) or another ASCII-friendly wording consistently throughout the doc.

Suggested change

	- Explaining what code does -> **code<->English translation block** (not a paragraph *about* the code)
	- Explaining what code does -> **code <-> English translation block** (not a paragraph *about* the code)