The desktop-protection shell guard inspected shell syntax and nested bash -c, but not script files passed to python, node, perl, ruby, or php. Read small workspace scripts and reject kill-family contents, and fall back to a kill/pkill/killall/xkill filename when the path cannot be read. Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>