Security: skill prints API tokens

[shmulc8]

The skill recommends echo $GEMINI_API_KEY and echo $GITHUB_TOKEN (examples, here). In an agent run, stdout can enter the model/transcript; please use presence-only checks such as test -n "${GITHUB_TOKEN:-}" instead.