fix(canister-security): correct inspect_message bypass wording; add evals

[marc0olo]

Summary

• Fixes incorrect wording in pitfall Bug Report: 9 verified issues across IC Skills (build-breaking, security, broken URLs) - From Claude #1: replaces "a malicious boundary node can bypass it" with the accurate explanation that `canister_inspect_message` runs on a single replica, and it is a malicious replica node that can skip the check. Boundary nodes are not involved in this mechanism. Wording now aligns with the official IC security docs.
• Adds `evaluations/canister-security.json` with 8 adversarial output evals and 17 trigger evals. All prompts show existing (potentially buggy) code and ask the agent to identify problems — no prompt guides toward the right answer.

Eval results

Output evals — WITH skill vs WITHOUT skill baseline

━━━ Adversarial: inspect_message as access control ━━━
  WITH skill:    5/5
  WITHOUT skill: 4/5 — omits single-replica/consensus bypass explanation

━━━ Adversarial: reentrancy guard with global boolean ━━━
  WITH skill:    5/5
  WITHOUT skill: 4/5 — recommends try/catch instead of finally for lock release

━━━ Adversarial: let _ = CallerGuard footgun ━━━
  WITH skill:    4/4
  WITHOUT skill: 4/4 (regression guard — Rust let _ semantics are general knowledge)

━━━ Adversarial: balance deducted after await ━━━
  WITH skill:    5/5
  WITHOUT skill: 4/5 — identifies TOCTOU but misses trap-case rollback (no try/finally)

━━━ Callback trap: where to release a lock ━━━
  WITH skill:    4/4
  WITHOUT skill: 1/4 — recommends try/catch (wrong), never mentions finally
                       or its IC-specific cleanup-context semantics

━━━ Adversarial: fetchRootKey in production ━━━
  WITH skill:    5/5
  WITHOUT skill: 5/5 (regression guard — widely known)

━━━ Anonymous principal check ━━━
  WITH skill:    4/4
  WITHOUT skill: 4/4 (regression guard — widely known)

━━━ Adversarial: serializing heap data in preupgrade ━━━
  WITH skill:    4/4
  WITHOUT skill: 2/4 — misses instruction-limit as failure mode,
                       never mentions persistent actor as the fix

Trigger evals

Should trigger:     9/9 correct
Should NOT trigger: 8/8 correct

[github-actions]

Skill Validation Report

Validating skill: /home/runner/work/icskills/icskills/skills/canister-security

Structure

• Pass: SKILL.md found

Frontmatter

• Pass: name: "canister-security" (valid)
• Pass: description: (415 chars)
• Pass: license: "Apache-2.0"
• Pass: metadata: (2 entries)

Markdown

• Pass: no unclosed code fences found

Tokens

File	Tokens
SKILL.md body	3,773
Total	3,773

Content Analysis

Metric	Value
Word count	2,244
Code block ratio	0.41
Imperative ratio	0.09
Information density	0.25
Instruction specificity	0.90
Sections	14
List items	18
Code blocks	8

Contamination Analysis

Metric	Value
Contamination level	low
Contamination score	0.03
Primary language category	systems
Scope breadth	2

• Warning: Language mismatch: shell (1 category differ from primary)

Result: passed

Project Checks

✓ Project checks passed for 1 skills (0 warnings)