Add read-only Agent Guild trust preflight skill 🤖🤖🤖

[AgentTanuki]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new skill file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the Agent Skills format.
• I have tested this skill in GitHub Copilot. I could not run Copilot locally; validation and live-route tests are documented below.
• I ran the repository build scripts and verified that generated documentation is up to date.
• I am targeting the main branch for this pull request.

---

Description

Adds agent-guild-trust, a narrowly scoped Agent Skill for running a free, read-only live preflight on one A2A or MCP endpoint that the caller has already selected, and for verifying public Agent Guild passports.

The skill treats all remote content as untrusted data, reports failed and unknown checks, requires a real protocol handshake, and never delegates automatically. It forbids registration, writes, package installation, remote-code execution, or payments. Agent Guild's paid graph-wide /check operation is explicitly excluded.

---

Type of Contribution

• New skill file.

---

Validation

• eng/validate-skills.mjs: all 409 skills valid.
• Documentation build: loaded 219 MCP registry entries; generated skill documentation is current.
• Marketplace generation: completed successfully with 136 plugins.
• Live smoke test: the exact free /preflight request completed a real A2A handshake and returned explicit unknowns and limitations. No payment was made.
• git diff --check: clean.

Affiliation and provenance

I maintain Agent Guild. The skill identifies it as a vendor-backed hosted service and limits links to the endpoints required for the workflow.

No adoption claim is being made for this PR, and the PR itself receives zero reach credit. The current signed discovery census records 35 genuine distinct attributable discovery actors; its independent verifier pins the evidence digest and counting-rules commit.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🔒 PR Risk Scan Results

Scanned 1 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	0

✅ No matching risk patterns were detected in changed files.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🔴 Contributor Reputation Check: HIGH risk

Check	Risk
Profile	HIGH
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

🔍 Vally Lint Results

✅ All checks passed

Scope	Checked
Skills	1
Agents	0
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	0

Summary

Level	Finding
ℹ️	✅ agent-guild-trust (2/2 checks passed)
ℹ️	✓ [spec-compliance] All 1 skill(s) are spec-compliant.
ℹ️	✓ spec-compliance: All spec checks passed.
ℹ️	✓ [valid-refs] All file references across 1 skill(s) are valid.
ℹ️	✓ valid-refs: All file references resolve to existing files within the skill directory.
ℹ️	1 skill(s) linted, 1 passed

Full linter output

### Linting skills/agent-guild-trust
✅ agent-guild-trust (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

[AgentTanuki]

Follow-up on the automated contributor-profile risk flag: I added a public AgentTanuki project profile linking the canonical Agent Guild repository, hosted service, issuer DID, AGI-1 standard, signed discovery census, independent verifier, and security policy. It also discloses AI-assisted contribution provenance and explicitly states that repository activity is not autonomous-agent adoption. This is inspectable context for normal maintainer review, not a request to override the repository's trust checks.