Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.agents/skills/apple-container/SKILL.md:
- Line 40: The documented command uses `sh -c` with interpolated `<test-args>`,
which permits shell metacharacters and command injection; change the example to
a shell-safe invocation that does not interpolate user args into the command
string (for example, run `sh -c` with positional parameter forwarding and pass
the test args after the `--` so they become "$@" inside the shell, or avoid `sh
-c` entirely and invoke `cargo run --release -- -m test` directly with the test
args as positional parameters); update the line containing `container exec
rustpython-test sh -c "cargo run --release -- -m test <test-args>"` to use safe
positional forwarding instead.
- Around line 32-34: The container run example in SKILL.md uses a hardcoded host
path in the mount (source=/Users/al03219714/Projects/RustPython3) which breaks
portability; update the documented command line for the "container run -d --name
rustpython-test -m 8G -c 4 \ ... -w /workspace rustpython-dev sleep infinity"
example to use a dynamic repo-root or current-directory variable (e.g., $(pwd)
or the output of git rev-parse --show-toplevel or an environment variable like
REPO_ROOT) for the --mount source instead of the hardcoded absolute path so the
command works on other machines.

In @.agents/skills/investigate-test-failure/SKILL.md:
- Line 4: The allowed-tools list in SKILL.md does not permit the gh CLI but the
skill uses a concrete gh issue create command; update the allowed-tools metadata
by adding an entry that permits this command (e.g., add Bash(gh issue create:*)
to the allowed-tools list) or remove/replace the gh issue create invocation in
the skill steps (search for the literal "gh issue create" and the allowed-tools
line in SKILL.md to apply the change).

In @.agents/skills/upgrade-pylib-next/SKILL.md:
- Line 4: The allowed-tools metadata entry (the allowed-tools list) is missing
permission for the workflow's cargo run usage; update the allowed-tools list to
include the cargo run tool (e.g., add an entry like Cargo(cargo run:*) or the
appropriate tool identifier for cargo run) so the workflow step that invokes
`cargo run` (the line referencing cargo run) is permitted; ensure you add this
alongside the existing Skill(upgrade-pylib) and Bash(...) entries to cover lines
13-17 where cargo run is used.

In @.agents/skills/upgrade-pylib/SKILL.md:
- Line 4: The allowed-tools metadata entry (the allowed-tools key in
.agents/skills/upgrade-pylib/SKILL.md) is missing commands used by the
documented steps; update that allowed-tools list to include the missing commands
(at minimum add git diff and cargo run) so the documented workflow commands are
permitted, and ensure any other commands referenced in the SKILL.md steps (e.g.,
scripts/update_lib invocations already present) are reflected in the same
allowed-tools list to keep metadata and documentation consistent.