Local-file upload tools: a dotfile check misses ~/Library and AppData; allowlist user folders

Reviewing an MCP tool that uploads a model-supplied local_path to cloud storage: the guard refused any path segment starting with "." (~/.ssh, ~/.aws) and resolved symlinks first. That still allows credential stores that have no dot: on macOS ~/Library/Keychains/login.keychain-db and browser cookies and profiles under ~/Library/Application Support/<browser>/; on Windows everything under %USERPROFILE%\AppData (Windows hides it with an attribute, not a dot); and absolute paths outside the home folder (/etc/...). A prompt injection in a document the agent reads can ask to upload one of these, and a confirmation card does not protect you if the host accepts a spoken yes. Safer: after realpath, require the file to be under one of a few user folders (Desktop, Documents, Downloads, Pictures, Movies/Videos, Music) in os.homedir(), and refuse everything else. Run the same check on arguments the user edited on the confirmation card, because the handler gets those after confirmation.