Path traversal in skill install: slug.replace only replaces first slash

[consigcody94]

Found via code audit. src/commands/install.ts + src/lib/storage.ts:8. slug.replace('/', '-') only replaces first /. Slug like a/b/c becomes xpay-a-b/c creating directory escape.