fix(runtime): reject path-escaping skill entry points

[cursor]

Summary

• Fixes a critical runtime path escape where SKILL.md / override entry_point values could leave the skill directory via absolute paths or ../ components. At sandbox level 1, execute_unsandboxed invoked the interpreter with that escaped path, allowing arbitrary host script execution.
• Adds shared script_path_under_skill_dir / ensure_entry_point_within_skill helpers in skilllite-core, wires them into metadata acceptance, run_skill, and the agent skill executor (parity with existing exec_script containment).
• Keeps legitimate nested relatives like scripts/main.py working; rejects absolute/traversal/drive/backslash forms fail-closed.

Bug Impact

• Arbitrary code execution outside the skill tree as the SkillLite process user at sandbox level 1.
• Concrete trigger: skill front matter entry_point: ../../../tmp/pwn.py (file exists) then SKILLLITE_SANDBOX_LEVEL=1 skilllite run <skill> '{}' printed OUTSIDE_EXECUTED before the fix.

Task Linkage

• Task ID: TASK-2026-078
• Task folder: tasks/TASK-2026-078-runtime-entry-point-path-safety/

Injected Specs

• spec/verification-integrity.md
• spec/task-artifact-language.md
• spec/security-nonnegotiables.md
• spec/rust-conventions.md
• spec/testing-policy.md
• spec/docs-sync.md (N/A: fail-closed validation only; no documented absolute entry_point support)
• spec/architecture-boundaries.md (reviewed; no boundary changes)

Validation Evidence

• Commands executed:
  • cargo test -p skilllite-core path_validation → 4 passed
  • cargo test -p skilllite-core test_entry_point → 3 passed
  • cargo test -p skilllite-core → 91 passed
  • cargo test -p skilllite-commands → 23 passed
  • cargo clippy -p skilllite-core -p skilllite-agent --all-targets -- -D warnings → clean
  • cargo fmt --check -p skilllite-core -p skilllite-commands -p skilllite-agent → clean
  • python3 scripts/validate_tasks.py → passed
  • Manual PoC at level 1: escaping front matter no longer executes outside script; legitimate scripts/main.py still works
• Key results:
  • Relative/absolute escapes rejected or ignored (fallback to in-tree convention)
  • Escape-only skill fails closed as prompt-only

Regression Scope

• Areas likely affected:
  • Skill metadata entry_point acceptance
  • skilllite run / agent skill execution overrides
• Explicit non-goals:
  • Evolution synthesis write-path hardening (open PR fix(evolution): reject path-escaping skill entry points #127)
  • Other open critical PRs (fix(evolution): constrain pending skill path operations #89, Fix Linux sandbox filtered network fail-open #112–Fix Life Pulse rhythm workspace scoping #116, fix(evolution): scope destructive reset to requested workspace #120–fix(stdio): reject sandbox level truncation #121, fix(artifact): reject Windows path escapes in store keys #123–fix(memory): reject path-escaping memory rel_path values #129)
  • Builtin file-tool symlink following (follow-up)
  • Unconstrained bash --cwd / OpenClaw import dest-name (follow-up candidates)

Docs Sync (EN/ZH)

• Not needed
• Updated EN + ZH docs
  Files:
  • N/A

Security Review Notes

• What security policy changed, and why is it needed? Runtime entry points must stay under the skill directory before interpreter spawn.
• Is default behavior more permissive? No — fail-closed.
• Does this affect SKILLLITE_* config semantics? No.
• Were tests and EN/ZH docs updated? Tests yes; docs N/A as above.

Review Checklist

• Acceptance criteria in tasks/TASK-2026-078-runtime-entry-point-path-safety/TASK.md satisfied
• tasks/TASK-2026-078-runtime-entry-point-path-safety/STATUS.md updated with latest progress
• tasks/TASK-2026-078-runtime-entry-point-path-safety/REVIEW.md includes merge readiness decision
• tasks/board.md status is up to date