Install
$ agentstack add skill-posidoni-shell-skill-shell-standards ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Shell standards
The non-negotiable baseline for writing Bash that does not silently corrupt data or hide failures. Every rule is explained in depth, with citations, in [reference/shell-standards.md](../../reference/shell-standards.md); the rules that carry a ShellCheck code also have a runnable good/bad pair in [examples/standards/](../../examples/standards/).
Rules at a glance
| # | Rule | Why | Enforced by | |---|------|-----|-------------| | 1 | set -euo pipefail at the top | Fail fast; unset vars and broken pipes become errors | style guide | | 2 | Quote every expansion: "$var", "$(cmd)" | Prevents word-splitting and globbing | SC2086 | | 3 | read -r, never bare read | Bare read mangles backslashes | SC2162 | | 4 | Declare local, then assign | local x="$(cmd)" hides the command's exit status | SC2155 | | 5 | Arrays for lists; expand "${arr[@]}" | A string can't hold an element with spaces | SC2206 | | 6 | [[ ... ]], not [ ... ] | [[ ]] doesn't split or glob its operands | SC2292 | | 7 | return from helpers, exit only in main | exit kills the caller's shell when sourced | style guide | | 8 | trap '...' EXIT for cleanup | Releases temp files on every exit path | style guide | | 9 | printf, not echo | Portable escapes; keep data out of the format | SC2028/SC2059 | | 10 | Brace expansions: ${var} | Disambiguates ${v}_x, arrays, defaults | SC2250 | | 11 | readonly constants; command -v not which | Immutability; portable existence check | style guide | | 12 | Never parse ls; use a glob | Breaks on odd filenames | SC2045 |
How to use
- Writing a script? Start from rule 1, quote everything (rule 2), and reach
for arrays (rule 5) the moment you have a list of arguments.
- Reviewing a script? Run
shellcheckat its default severity (this
repo's .shellcheckrc sets enable=all); the SC codes above map directly to these rules. CI lints at --severity=warning, which catches the higher-severity codes but filters out SC2086/SC2162 (info) and SC2292 (style) — so review locally at the default level to see them all.
- Formatting?
shfmt(configured in.editorconfig) enforces layout — it
even rewrites legacy backticks to $(...) for you, which is why there is no runnable backticks example here.
See also: [skills/bash](../bash/), [skills/zsh](../zsh/), and [skills/nushell](../nushell/) for shell-specific guidance.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: posidoni
- Source: posidoni/shell-skill
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.