fn sanitize_trigger(trigger: &str) -> Option<&str>Expand description
Validate a skill’s trigger is safe to use as a single path segment in
.claude/commands/<trigger>.md. trigger is free-form user input with
no format validation anywhere upstream (the skill create/update RPCs and
the frontend form all accept it as-is), so a trigger containing a path
separator or a .. segment previously let the resulting filename
resolve OUTSIDE the agent’s working directory – both for this write and,
once stale-file cleanup existed, for the corresponding delete (reagent
P1, PR #2322). Rejects (returns None) anything containing / or \,
or that is exactly ./..; callers skip writing that skill’s command
file entirely rather than silently rewriting the trigger into something
the user didn’t ask for.