chore(skills): Add security notes for injection defense

[github-actions]

Note

The pull request "chore(skills): Add security notes for injection defense" was created by @s1gr1d but did not reference an issue. Therefore this issue was created for better visibility in external tools like Linear.

We don't merge the user prompt with the system prompt, so it's easier to separate them. But we still need to set up some guards.

[linear]

JS-1741