[Bug]: forge skills audit reports incorrect/missing egress domains for some skills (weather, github)

[zaidoskate]

Component

forge-skills (skill parser, compiler, analyzer, trust)

Description

The forge skills audit command doesn't correctly report egress domains for some skills. For weather, egress_domains: [wttr.in] is declared in SKILL.md but the audit output shows no egress factor at all for it. For github (pre-existing, unrelated to any change I made), the audit shows unknown domain: api.g — truncated instead of api.github.com.

This looks related to existing test failures already present on main:

• TestEmbeddedRegistry_GitHubDetails: EgressDomains = [api.g], want api.github.com
• TestEmbeddedRegistry_TavilySearchDetails: EgressDomains = [], want api.tavily.com

Possibly a shared slice/buffer being reused incorrectly while building the egress domain list across multiple skills in the same loop.

Steps to reproduce

1. Build the forge CLI from forge-cli (go build -o forge.exe ./cmd/forge)
2. Run forge skills audit --embedded (or --dir pointing at forge-skills/local/embedded)
3. Check the egress factors listed for the weather and github skills in the report

Expected behavior

weather should show an egress factor referencing wttr.in (its declared egress_domains entry), similar to how other skills like codegen-html correctly show unknown domain: cdn.tailwindcss.com.

github should show unknown domain: api.github.com (or a "trusted domain" factor, matching what's declared in its SKILL.md), not a truncated api.g.

Actual behavior

weather shows no egress factor at all in the audit report, as if egress_domains were empty — even though SKILL.md declares egress_domains: [wttr.in].

github shows egress +10 unknown domain: api.g — the domain string appears truncated.

Operating system

Windows 11

Go version

go version go1.26.3 windows/amd64

forge.yaml (if relevant)

Logs / error output

weather                      Risk: low (3/100)
  Factors:
    binary   +3   standard binary: curl
  Violations: none

github                       Risk: low (24/100)
  Factors:
    egress   +10  unknown domain: api.g
    binary   +3   standard binary: gh
    binary   +3   standard binary: git
    binary   +3   standard binary: jq
    env      +5   API key: GH_TOKEN
  Violations: none
  Recommendations:
    - Verify unknown egress domains are expected and add to trusted list if appropriate

[initializ-mk]

Thanks, @zaidoskate. I am reviewing this issue. I can assign it to you once I confirm it.