Install
$ agentstack add skill-posidoni-shell-skill-zsh ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ● Shell / process execution Used
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Zsh
Depth and citations in [reference/zsh.md](../../reference/zsh.md). Two framing facts: ShellCheck and shfmt do not support zsh (syntax-check with zsh -n), and zsh's edge is doing work without forking a subprocess.
Robust scripting
| Rule | Why | |------|-----| | emulate -L zsh in functions, emulate -LR zsh in scripts | reset options; a caller's setopt can't change your behaviour | | setopt err_return (not errexit in sourced code), no_unset, pipefail, warn_create_global | fail fast without killing the shell; catch leaked globals | | No auto word-splitting; split with ${=v} / ${(s:X:)v} / ${(f)v} | unquoted $var stays one word (unlike Bash) | | Arrays are 1-indexed: $arr[1], $#arr, arr+=(x), "${(@)arr}" | ${arr[0]} is the wrong element | | Quote for re-parse with ${(q)v}; indirect with ${(P)name} | safe eval/ssh; no ${!name} | | zparseopts -D -E -F | robust option parsing |
Performance (romkatv): never fork in a hot path
| Rule | Why | |------|-----| | $TTY, never $(tty) | fork cost, and $(tty) reads fd 0 — wrong under redirected stdin / instant prompt; $TTY is the shell's controlling terminal | | ${f:h} / ${f:t} / ${f:r} / ${f:e} / ${f:A} not dirname/basename/realpath | in-process string ops, no fork | | $EPOCHREALTIME / $EPOCHSECONDS not $(date) | zmodload zsh/datetime | | ${${(%):-%x}:A:h} for a script's own dir; ${(%):-%N} / $funcstack | no readlink fork | | (( $+commands[x] )) via zsh/parameter | existence check with no command -v fork | | [[ ]] / (( )) not [ ]/test/expr; $(<file) not $(cat file) | keywords/builtins, no fork | | glob qualifiers (.)/(N)/(om) + ** not find/ls | in-process, robust on odd filenames |
Verify
zsh -n script.zsh for syntax; there is no ShellCheck for zsh. For anything that must be linted and portable, write Bash instead.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: posidoni
- Source: posidoni/shell-skill
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.