What
When extraction of a bundled file is blocked for trying to escape its target directory, the error is now the fixed text "bundled file path escapes its extraction dir" instead of quoting the path back.
Details
- Previously the message named the skill and interpolated the rejected path, putting untrusted text into an error string.
- The guard itself is unchanged; only what it reports changed.
Evidence
bundled file path escapes its extraction dir
Strings lifted out of the shipped bundle, so the claim above can be checked against them.