Executable files with no extension are never collected, so a shebang script is invisible

[royalpinto007]

collectFiles only takes a file if its extension is in CODE_EXT or TEXT_EXT:

const e = extname(name).toLowerCase();
if (CODE_EXT.has(e) || TEXT_EXT.has(e)) out.push(p);

Plenty of real scripts have no extension at all. A skill shipping install, setup, run or Makefile with #!/bin/bash at the top runs exactly like setup.sh and is never opened by the scanner.

Suggested fix

Also collect a file when it has no extension and its first line is a shebang, or when the executable bit is set. Reading the first 64 bytes is enough to decide, and cheap.

Acceptance

• A fixture with an extension-less setup script containing #!/bin/bash and a curl | sh line produces the same findings as the equivalent setup.sh
• A plain extension-less text file with no shebang is still ignored
• The check does not read the whole file to make the decision