sync: malware page, security alerts, review diagnostics, skill detail improvements

- Add malware security advisory page and SecurityAlertBanner component
- Add review diagnostics API and reviewed stats page
- Improve skill detail page with better scoring display and metadata
- Update review API endpoints with enhanced filtering and stats
- Add skill file serving improvements and cache enhancements
- Remove legacy curation scripts (moved to internal tooling)
- Update CLI search with score filtering support

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/src/commands/install.ts

@@ -39,6 +39,14 @@ export async function install(skillId: string, options: InstallOptions): Promise
       try {
         skillInfo = await getSkill(skillId);
         if (skillInfo) {
+          // Block installation of malicious skills
+          if (skillInfo.isMalicious) {
+            spinner.fail(chalk.red('This skill has been flagged as malicious (contains malware).'));
+            console.log(chalk.red('Installation blocked for your safety.'));
+            console.log(chalk.dim(`See: https://skills.palebluedot.live/en/skill/${skillId}`));
+            process.exit(1);
+          }
+
           const reviewBadge = skillInfo.aiScore && skillInfo.reviewStatus === 'ai-reviewed'
             ? chalk.dim(` | AI: ${skillInfo.aiScore}/100`)
             : skillInfo.reviewStatus === 'verified'