GoKawiilShell tool nono flags a PATH tilde-expansion bug affecting bash and zsh configs
A developer testing the nono agent sandboxing tool received a warning about a writable PATH entry '~/.local/bin/', which led to the discovery that quoted tilde expressions in PATH exports (e.g. export PATH="$PATH:~/.local/bin/") do not expand to the home directory. Instead, bash and zsh interpret the tilde literally, creating a relative directory named './~/.local/bin/' that programs can be tricked into running from. The fix is to use $HOME explicitly instead of a quoted tilde, and users are advised to check their PATH with a grep command for stray tildes.