fix(skills): avoid a literal $1 placeholder in the security-review sql example

Invoking this skill with arguments substitutes a literal $1 away, so the
"ALWAYS Use Parameterized Queries" example renders as

  'SELECT * FROM users WHERE email = attacks'

for `/security-review also attacks` -- concatenated SQL, which is exactly
the anti-pattern the section above it warns against. The one place the
skill must be unambiguous is the one place argument substitution rewrites.

Switches the raw-SQL example to "?" and names the Postgres numbered form
in prose, so the lesson is unchanged and no substitutable token is left.
Adds a comment so the placeholder is not reintroduced.

skills/security-review/SKILL.md

@@ -124,13 +124,20 @@ const { data } = await supabase
   .select('*')
   .eq('email', userEmail)
 
-// Or with raw SQL
+// Or with raw SQL -- the value goes in the params array, never in the
+// string. Use your driver's placeholder syntax (Postgres numbers its
+// placeholders, MySQL uses "?").
 await db.query(
-  'SELECT * FROM users WHERE email = $1',
+  'SELECT * FROM users WHERE email = ?',
   [userEmail]
 )
 ```
 
+<!-- Do not write a literal dollar-sign-N placeholder anywhere in this file.
+     Invoking this skill with arguments substitutes it away, and the example
+     above then renders as concatenated SQL -- the exact anti-pattern this
+     section warns against. Use "?" and name the Postgres form in prose. -->
+
 #### Verification Steps
 - [ ] All database queries use parameterized queries
 - [ ] No string concatenation in SQL