- Add resolve() + is_relative_to() check in _extract_zip() to block
nested traversal entries like nested/../../escape.txt
- Sanitize server-provided skill name in import_skill() to prevent
directory escape via malicious record metadata
- Add 6 regression tests covering both attack vectors
Closes#17
Co-authored-by: LeftX <xzq-xu@users.noreply.github.com>