chore: apply AI code review suggestions from PR #42

- hooks/deny-vendor-write.sh: fail-open → fail-closed for path canonicalization
  (cubic-dev-ai: path traversal bypass via realpath failure)
- .claude/commands/generate-skill.md: quote $ARGUMENTS in shell commands
  (cubic-dev-ai: word-splitting/path expansion bugs with unquoted variables)

Author: amondnet

.claude/commands/generate-skill.md

@@ -18,7 +18,7 @@ Follow the guidelines in `docs/skills-generator.md` to generate Type 1 skills.
    - `references/*.md` — one file per concept (prefixed by category, e.g. `core-syntax.md`, `features-plugins.md`)
 5. **Copy** the generated skills into the plugin directory:
    ```bash
-   mkdir -p plugins/$ARGUMENTS/skills/$ARGUMENTS/ && cp -r skills/$ARGUMENTS/. plugins/$ARGUMENTS/skills/$ARGUMENTS/
+   mkdir -p "plugins/$ARGUMENTS/skills/$ARGUMENTS/" && cp -r "skills/$ARGUMENTS/." "plugins/$ARGUMENTS/skills/$ARGUMENTS/"
    ```
    > Note: `bun run skills:sync` only handles Type 2 (vendor) and Type 3 (manual) skills.
    > Type 1 (generated) skills must be copied manually to the plugin directory.

hooks/deny-vendor-write.sh

@@ -36,7 +36,16 @@ case "$file_path" in
 esac
 
 # .. 세그먼트를 정규화하여 경로 우회 방지 (realpath -m은 파일이 없어도 작동)
-abs_path="$(realpath -m "$abs_path" 2>/dev/null || echo "$abs_path")"
+# fail-open 대신 fail-closed: 경로 정규화 실패 시 요청 차단
+if ! abs_path="$(realpath -m "$abs_path" 2>/dev/null)"; then
+  echo '{
+  "hookSpecificOutput": {
+    "permissionDecision": "deny",
+    "permissionDecisionReason": "경로 정규화에 실패하여 요청을 차단했습니다."
+  }
+}' >&2
+  exit 2
+fi
 
 # 쓰기 금지 디렉토리 목록 확인 (프로젝트 루트에 앵커링)
 project_dir="${CLAUDE_PROJECT_DIR%/}"