feat(skills): package 2 Weaviate skills

[JAORMX]

Packages 2 skills from weaviate/agent-skills (BSD-3-Clause), pinned to 2f62f9f.

Skills added

• weaviate — vector DB operations (semantic, hybrid, keyword search; Query Agent; collection management; PDF/CSV/JSON imports)
• weaviate-cookbooks — AI-application blueprints (Query Agent Chatbot, Data Explorer, Multimodal RAG, Basic/Advanced RAG, Basic Agent, Agentic RAG)

Security allowlists

• MANIFEST_MISSING_LICENSE (INFO): upstream BSD-3-Clause at repo root, no per-skill SPDX.
• weaviate: TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL (apt-get install for PDF OCR dependencies).
• weaviate-cookbooks: PIPELINE_TAINT_FLOW (documented uv and ollama installer curl | sh commands; scanner itself flags as 'well-known installer').

Test plan

• task validate-skill on both — VALID
• task scan-skill passes after allowlist
• CI green
• 2 OCI artifacts published

Closes #493

[github-actions]

🛡️ Skill Security Scan Results

✅ weaviate

• Status: Passed
• Findings: 2
• Allowed (not blocking): 2
  • MANIFEST_MISSING_LICENSE (Allowed: weaviate/agent-skills is licensed BSD-3-Clause at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)
  • TOOL_ABUSE_SYSTEM_PACKAGE_INSTALL (Allowed: The skill's PDF-import helper references an apt-get install command for OCR/PDF system dependencies as documentation. The command runs only when the user explicitly performs a PDF import; documented in SKILL.md.)

✅ weaviate-cookbooks

• Status: Passed
• Findings: 3
• Allowed (not blocking): 3
  • MANIFEST_MISSING_LICENSE (Allowed: weaviate/agent-skills is licensed BSD-3-Clause at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)
  • PIPELINE_TAINT_FLOW (Allowed: The cookbook references the official astral.sh/uv and ollama.com installers (curl | sh) as documented prerequisites for running the RAG/agent cookbook examples. The scanner itself flags both as 'well-known installer URL' / 'instructional rather than executable'.)
  • PIPELINE_TAINT_FLOW (Allowed: The cookbook references the official astral.sh/uv and ollama.com installers (curl | sh) as documented prerequisites for running the RAG/agent cookbook examples. The scanner itself flags both as 'well-known installer URL' / 'instructional rather than executable'.)

---

Summary: Scanned 2 skill(s), all passed security checks. ✅