# Shell Standards

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-posidoni-shell-skill-shell-standards`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [posidoni](https://agentstack.voostack.com/s/posidoni)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [posidoni](https://github.com/posidoni)
- **Source:** https://github.com/posidoni/shell-skill/tree/main/skills/shell-standards

## Install

```sh
agentstack add skill-posidoni-shell-skill-shell-standards
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Shell standards

The non-negotiable baseline for writing Bash that does not silently corrupt data
or hide failures. Every rule is explained in depth, with citations, in
[`reference/shell-standards.md`](../../reference/shell-standards.md); the rules
that carry a ShellCheck code also have a runnable good/bad pair in
[`examples/standards/`](../../examples/standards/).

## Rules at a glance

| # | Rule | Why | Enforced by |
|---|------|-----|-------------|
| 1 | `set -euo pipefail` at the top | Fail fast; unset vars and broken pipes become errors | style guide |
| 2 | Quote every expansion: `"$var"`, `"$(cmd)"` | Prevents word-splitting and globbing | `SC2086` |
| 3 | `read -r`, never bare `read` | Bare `read` mangles backslashes | `SC2162` |
| 4 | Declare `local`, then assign | `local x="$(cmd)"` hides the command's exit status | `SC2155` |
| 5 | Arrays for lists; expand `"${arr[@]}"` | A string can't hold an element with spaces | `SC2206` |
| 6 | `[[ ... ]]`, not `[ ... ]` | `[[ ]]` doesn't split or glob its operands | `SC2292` |
| 7 | `return` from helpers, `exit` only in `main` | `exit` kills the caller's shell when sourced | style guide |
| 8 | `trap '...' EXIT` for cleanup | Releases temp files on every exit path | style guide |
| 9 | `printf`, not `echo` | Portable escapes; keep data out of the format | `SC2028`/`SC2059` |
| 10 | Brace expansions: `${var}` | Disambiguates `${v}_x`, arrays, defaults | `SC2250` |
| 11 | `readonly` constants; `command -v` not `which` | Immutability; portable existence check | style guide |
| 12 | Never parse `ls`; use a glob | Breaks on odd filenames | `SC2045` |

## How to use

- **Writing a script?** Start from rule 1, quote everything (rule 2), and reach
  for arrays (rule 5) the moment you have a list of arguments.
- **Reviewing a script?** Run `shellcheck` at its **default** severity (this
  repo's `.shellcheckrc` sets `enable=all`); the SC codes above map directly to
  these rules. CI lints at `--severity=warning`, which catches the
  higher-severity codes but filters out `SC2086`/`SC2162` (info) and `SC2292`
  (style) — so review locally at the default level to see them all.
- **Formatting?** `shfmt` (configured in `.editorconfig`) enforces layout — it
  even rewrites legacy backticks to `$(...)` for you, which is why there is no
  runnable backticks example here.

See also: [`skills/bash`](../bash/), [`skills/zsh`](../zsh/), and
[`skills/nushell`](../nushell/) for shell-specific guidance.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [posidoni](https://github.com/posidoni)
- **Source:** [posidoni/shell-skill](https://github.com/posidoni/shell-skill)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-posidoni-shell-skill-shell-standards
- Seller: https://agentstack.voostack.com/s/posidoni
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.