ci: add KYA security scan for MCP dependencies

[Thezenmonster]

Automated MCP dependency security scanning on every push and PR via KYA Scan.

What it checks per dependency:

• Abuse database: has this package been reported for malicious behaviour?
• Install scripts: does the package run code on npm install?
• Suspicious URLs: hardcoded IPs or exfiltration domains?
• Prompt injection: manipulation patterns in package metadata?
• Metadata quality: missing repo, licence, or description?

919 MCP packages scanned. 98.5% clean. This catches the rest before they reach your project.

Free, no API key, no configuration. One YAML file, zero code changes.

KYA Scan Action | Scanner

[Thezenmonster]

Hi team - single YAML file adding automated dependency scanning to CI. Checks npm deps against the KYA community abuse database on push/PR for install scripts, suspicious URLs, and prompt injection patterns. Pinned to commit SHA, read-only permissions. Happy to discuss or adjust.