Problem

Sensei v1.2.0+ includes a spec-security check that validates:

1. No XML angle brackets (< >) in frontmatter values (injection risk)
2. Skill name does not use reserved prefixes (claude-, anthropic-)

Waza has no equivalent check.

Expected Behavior

Add a SpecSecurityChecker to internal/checks/ that:

• Flags XML angle brackets in frontmatter description and other string fields
• Flags skill names starting with claude- or anthropic- (reserved per Anthropic guide p31)
• Returns StatusWarning for violations

References

• spboyer/sensei references/scoring.md — spec-security check definition
• Anthropic Complete Guide to Building Skills, p31

Acceptance Criteria

• New SpecSecurityChecker in internal/checks/
• Detects < > in frontmatter
• Detects reserved name prefixes
• Tests covering both cases