fix(skills): detect temp-root traversal deletes

tests/tools/test_skills_guard.py

@@ -253,6 +253,20 @@ class TestScanFile:
         bad.write_text("rm -rf /etc/hosts\nrm -rf /home/user\nrm -rf /\n", encoding="utf-8")
         assert len([fi for fi in scan_file(bad, "bad.sh") if fi.pattern_id == "destructive_root_rm"]) == 3
 
+    def test_rm_rf_temp_root_traversal_is_destructive_root_rm(self, tmp_path):
+        """#111335: a temp-root exemption must not hide a parent traversal."""
+        bypasses = tmp_path / "temp-root-traversal.sh"
+        bypasses.write_text(
+            "rm -rf /tmp/../etc\n"
+            "rm -rf /tmp/cache/../../etc\n"
+            "rm -rf /var/tmp/../etc\n"
+            "rm -rf /dev/shm/../etc\n"
+            "rm -rf /run/../etc\n",
+            encoding="utf-8",
+        )
+        findings = scan_file(bypasses, "temp-root-traversal.sh")
+        assert len([fi for fi in findings if fi.pattern_id == "destructive_root_rm"]) == 5
+
 
 # ---------------------------------------------------------------------------
 # scan_skill — directory scanning

tools/skills_guard.py

@@ -197,8 +197,11 @@ THREAT_PATTERNS = [
      "hidden_div", "high", "injection", "hidden HTML div (invisible instructions)"),
     # ── Destructive operations ──
     # Cleanup under the standard temp roots (/tmp, /var/tmp, /dev/shm, /run) is routine in
-    # test/smoke scripts and CI; anything else rooted at "/" stays critical.
-    (r'rm\s+-rf\s+/(?!tmp(?:\b|/)|var/tmp(?:\b|/)|dev/shm(?:\b|/)|run(?:\b|/))',
+    # test/smoke scripts and CI. A parent segment inside an exempted root can escape it,
+    # so it remains destructive along with every other path rooted at "/".
+    (r'rm\s+-rf\s+/(?:'
+     r'(?!tmp(?:\b|/)|var/tmp(?:\b|/)|dev/shm(?:\b|/)|run(?:\b|/))'
+     r'|(?:tmp|var/tmp|dev/shm|run)/(?:[^/\s]+/)*\.\.(?=/|\s|$))',
      "destructive_root_rm", "critical", "destructive", "recursive delete from root"),
     (r'rm\s+(-[^\s]*)?r.*\$HOME|\brmdir\s+.*\$HOME',
      "destructive_home_rm", "critical", "destructive", "recursive delete targeting home directory"),