docs(coding-agent): add security warnings for third-party packages

- README.md: Pi Packages section
- packages.md: Install and Manage section
- extensions.md: Extension Locations section
- skills.md: Locations section

packages/coding-agent/docs/skills.md

@@ -19,6 +19,8 @@ Pi implements the [Agent Skills standard](https://agentskills.io/specification),
 
 ## Locations
 
+> **Security:** Skills can instruct the model to perform any action and may include executable code the model invokes. Review skill content before use.
+
 Pi loads skills from:
 
 - Global: `~/.pi/agent/skills/`
@@ -50,7 +52,7 @@ For project-level Claude Code skills, add to `.pi/settings.json`:
 
 ```json
 {
-  "skills": [".claude/skills"]
+  "skills": ["../.claude/skills"]
 }
 ```