security(skills): warn when safety metadata is unavailable

Add MetadataAvailable flag to InstallResult. When the registry
metadata fetch fails (silent fallback), the user now sees a
warning that safety checks could not be completed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

pkg/skills/clawhub_registry.go

@@ -248,6 +248,7 @@ func (c *ClawHubRegistry) DownloadAndInstall(
 		result.IsMalwareBlocked = meta.IsMalwareBlocked
 		result.IsSuspicious = meta.IsSuspicious
 		result.Summary = meta.Summary
+		result.MetadataAvailable = true
 	}
 
 	// Step 2: Resolve version.

pkg/skills/registry.go

@@ -36,10 +36,11 @@ type SkillMeta struct {
 // InstallResult is returned by DownloadAndInstall to carry metadata
 // back to the caller for moderation and user messaging.
 type InstallResult struct {
-	Version          string
-	IsMalwareBlocked bool
-	IsSuspicious     bool
-	Summary          string
+	Version           string
+	IsMalwareBlocked  bool
+	IsSuspicious      bool
+	Summary           string
+	MetadataAvailable bool
 }
 
 // SkillRegistry is the interface that all skill registries must implement.

pkg/tools/skills_install.go

@@ -159,10 +159,13 @@ func (t *InstallSkillTool) Execute(ctx context.Context, args map[string]any) *To
 		_ = err
 	}
 
-	// Build result with moderation warning if suspicious.
+	// Build result with moderation warnings.
 	var output string
+	if !result.MetadataAvailable {
+		output += fmt.Sprintf("Warning: safety metadata was not available for skill %q. Exercise caution.\n\n", slug)
+	}
 	if result.IsSuspicious {
-		output = fmt.Sprintf("⚠️ Warning: skill %q is flagged as suspicious (may contain risky patterns).\n\n", slug)
+		output += fmt.Sprintf("⚠️ Warning: skill %q is flagged as suspicious (may contain risky patterns).\n\n", slug)
 	}
 	output += fmt.Sprintf("Successfully installed skill %q v%s from %s registry.\nLocation: %s\n",
 		slug, result.Version, registry.Name(), targetDir)