nanobot: 2026-09-11 15:17:08

AGENTS.md

@@ -34,6 +34,10 @@ Never use `/tmp/`, hardcoded absolute paths, or in-memory databases for persiste
 
 The exec safety guard blocks commands without an explicit workspace path (e.g. `lua -e '...'`, `which`). Write scripts to files inside the workspace (e.g. `tmp/script.lua`) and run them with `working_dir` set to the workspace root.
 
+**Never put prose or user-supplied text into a command string** — not as an argument, not in a heredoc, not through a pipe. The guard scans the raw command string and has no shell parser, so quoting does not help. Any `X:` where `X` is an ASCII letter not preceded by another ASCII letter parses as a Windows drive path and blocks the whole command: Czech `Cíl:`, `Závěr:`, `směr:` all trip it (the diacritic before the letter defeats the guard's ASCII-only lookbehind), and so does `date '+%H:%M:%S'`. A literal `../` anywhere in the command — even inside prose — trips the traversal guard too.
+
+Instead: `write_file` the text to `tmp/`, then pass the **path** (`--file tmp/x.md`, or `< tmp/x.md`). A path in the command is safe, and file tools are not subject to this guard. Skill CLIs that take text follow this — see `skills/project` and `skills/note`.
+
 ## python — use uv
 
 For all Python code use `uv`, never `python` / `python3` / `pip` / `poetry` / `conda` directly. Details in `skills/python/SKILL.md`.