feat(skills): add cli skill test command

[JingHou1215]

Description

Adds an initial CLI entrypoint for validating individual QwenPaw skills before assigning them to agents.

This PR introduces qwenpaw skills test <skill>, supporting validation by workspace skill name or local skill directory path. The command checks that SKILL.md exists, validates required frontmatter fields (name and description), and runs the existing skill security scanner with blocking enabled.

Related Issue: Relates to #3883

Security Considerations: Uses the existing skill security scanner, so skills with blocking security findings fail validation.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Refactoring

Component(s) Affected

• Core / Backend (app, agents, config, providers, utils, local_models)
• Console (frontend web UI)
• Channels (DingTalk, Feishu, QQ, Discord, iMessage, etc.)
• Skills
• CLI
• Documentation (website)
• Tests
• CI/CD
• Scripts / Deploy

Checklist

• I ran pre-commit run --all-files locally and it passes
• If pre-commit auto-fixed files, I committed those changes and reran checks
• I ran tests locally (pytest or as relevant) and they pass
• Documentation updated (if needed)
• Ready for review

For Channel Changes (DingTalk, Feishu, QQ, Console, etc.)

• I ran ./scripts/check-channels.sh (or ./scripts/check-channels.sh --changed) and it passes
• Contract test exists in tests/contract/channels/test_<channel>_contract.py (REQUIRED)
• Contract test implements create_instance() with proper channel initialization
• All 19 contract verification points pass (see tests/contract/channels/__init__.py)
• Optional: Unit tests in tests/unit/channels/test_<channel>.py for complex internal logic

Testing

• .\.venv\Scripts\python.exe -m pytest tests\unit\cli\test_cli_skills.py tests\unit\workspace\test_cli_agent_id.py → 13 passed
• .\.venv\Scripts\pre-commit.exe run --files src\qwenpaw\cli\skills_cmd.py tests\unit\cli\test_cli_skills.py → passed

Local Verification Evidence

• pre-commit run --all-files → passed
• pytest → passed

[github-actions]

Welcome to QwenPaw! 🐾

Hi @JingHou1215, thank you for your first Pull Request! 🎉

🙌 Join Developer Community

Thanks so much for your contribution! We'd love to invite you to join the official QwenPaw developer group! You can find the Discord and DingTalk group links under the "Developer Community" section on our docs page:
https://qwenpaw.agentscope.io/docs/community

We truly appreciate your enthusiasm—and look forward to your future contributions! 😊

We'll review your PR soon.

[Leirunlin]

Hi! @JingHou1215 Thanks for the PR. I have reviewed the PR and have the below suggestions:

• For workspace skills, runtime behavior is still keyed by directory name, so skills test should not switch to using the declared frontmatter name for scan identity / output. If those two drift, this command can validate or report the skill under a different name than the rest of the system uses, which is misleading and can affect scan/whitelist behavior.
  I think this should keep directory name as the primary identity for workspace skills, and use frontmatter only for validation.

• No additional unit test is needed here.