# Writing Shell

> Idiomatic shell development for POSIX sh, Bash, Zsh, Fish, hooks, CI

- **Type:** Skill
- **Install:** `agentstack add skill-alexei-led-cc-thingz-writing-shell`
- **Verified:** Pending review
- **Seller:** [alexei-led](https://agentstack.voostack.com/s/alexei-led)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [alexei-led](https://github.com/alexei-led)
- **Source:** https://github.com/alexei-led/cc-thingz/tree/master/dist/claude/plugins/programming/skills/writing-shell

## Install

```sh
agentstack add skill-alexei-led-cc-thingz-writing-shell
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Shell Development

## Scope

- Use for shell scripts, hooks, CI shell blocks, command pipelines, and local automation glue.
- Do not use for cloud, Kubernetes, Terraform, host, or network operations; use `operating-infra`.
- Do not use for application logic that belongs in Python, Rust, Go, TypeScript, or another project language.

## Read references

- Read [patterns.md](references/patterns.md) before non-trivial scripts or pipelines.
- Read [tools.md](references/tools.md) when choosing external CLI tools or parsing structured data.
- Read [testing.md](references/testing.md) before adding or changing shell tests or quality gates.

## Defaults

- Follow the existing shebang, shell, style, and project tooling first.
- For new portable scripts, use POSIX `sh` when the logic is simple; use Bash when arrays, `pipefail`, regex, or richer functions are needed.
- Use Zsh or Fish only for existing files or explicit user intent. Keep Fish/Zsh config separate from portable scripts.
- Do not rely on the agent's current shell. Put the intended shell in the shebang or invoke it explicitly in tests.
- Prefer small shell scripts that call stable tools. Move complex data modeling or business logic to a real language.

## Core rules

- Quote expansions unless word splitting is intentional and documented by structure.
- Avoid `eval`, `curl | sh`, parsing `ls`, unguarded globbing, and unsafe `rm`/`mv`/`cp` paths.
- Use arrays for arguments in Bash; use newline/NUL-safe loops for filenames.
- Use `mktemp` plus cleanup traps for temporary files and directories.
- Check required external commands when a script depends on them. Do not install tools silently.
- Account for macOS/BSD versus GNU flag differences when writing portable scripts.
- Prefer machine-readable output from tools, then parse it with structured parsers.
- Use `looking-up-docs` for exact external CLI flags, syntax, or version behavior; do not guess from memory.

## Comments

- Comment only tricky, non-obvious, important, or unusual shell behavior.
- Use file and function comments for reusable scripts or functions when the contract is not obvious from names and usage.
- Add a short reason after any `shellcheck disable` directive.
- Keep comments short. Move longer rationale to docs, issue links, or design notes.
- Do not comment obvious commands or narrate each pipeline stage.
- Keep shell tests readable without comments; add one only for unobvious fixtures, environment setup, portability constraints, or regression context.

## Verification

Run the project-configured shell gates. Prefer:

- formatting: `shfmt`
- linting: `shellcheck`; `checkbashisms` for POSIX `sh`
- tests: Bats for Bash-heavy projects; ShellSpec for POSIX or multi-shell behavior
- security/policy: Semgrep shell rules when the script handles secrets, downloads, deletion, or user-controlled input

If a tool is unavailable or unconfigured, state the gap and run the closest available check. If a check fails, quote the diagnostic, fix the cause, and rerun the relevant check.

## Final response

Include:

- changed files
- shell target used: POSIX sh, Bash, Zsh, or Fish
- checks run and results
- checks skipped with reasons
- remaining portability or safety risks

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [alexei-led](https://github.com/alexei-led)
- **Source:** [alexei-led/cc-thingz](https://github.com/alexei-led/cc-thingz)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-alexei-led-cc-thingz-writing-shell
- Seller: https://agentstack.voostack.com/s/alexei-led
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.