create-locked-down-skill

This is a defensive directory-jail hook, not apparent malware, but it contains significant security flaws for a path-enforcement component. Symlink handling and the jail-prefix check can permit access outside the intended directory, and interpolation of an untrusted path into `python3 -c` can enable Python code injection. The implementation should use argument-safe canonicalization, resolve the complete target including symlinks, and enforce a path-boundary-aware containment check. Fail-open behavior when jq or jail resolution fails should also be reconsidered.