fix: migrate security fixes to actorization skill

[patrikbraborec]

Summary

• Migrate security hardening from apify-actor-development to apify-actorization skill (originally applied in commits 7fcaa38 and df2cb1e)
• Replace curl|bash / irm|iex CLI install patterns with package manager installs
• Replace apify login -t $APIFY_TOKEN with env var / interactive login to avoid token exposure in shell history
• Add dedicated Security section covering untrusted content handling, prompt injection prevention, credential isolation, supply-chain checks, and version pinning

Test plan

• Verify actorization SKILL.md prerequisites match actor-development security patterns
• Verify new Security section content matches actor-development Security section

🤖 Generated with Claude Code

[B4nan]

Replace curl|bash / irm|iex CLI install patterns with package manager installs

I don't really understand why you call this a security risk, it's not a random CURL call, it's a call to our own domain with our own script.

Using NPM is fine for Node.js projects, not so much for python or any other language. That's the whole point why we provided the bundled executables that require this approach for installation.

[lukas-bekr]

I don't really understand why you call this a security risk, it's not a random CURL call, it's a call to our own domain with our own script.

It's because of automatic security checks on skills.sh