# Shell Discipline

> Shell discipline — one command per call, no inline env vars, gh auth login.

- **Type:** Skill
- **Install:** `agentstack add skill-swell-agents-coding-skills-shell-discipline`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [swell-agents](https://agentstack.voostack.com/s/swell-agents)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [swell-agents](https://github.com/swell-agents)
- **Source:** https://github.com/swell-agents/coding-skills/tree/main/skills/shell-discipline

## Install

```sh
agentstack add skill-swell-agents-coding-skills-shell-discipline
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

## Shell Commands

- **One command per call** — keep commands small, readable, and atomic. Don't chain with `&&`, `;`, or `cd dir && command`. Use separate calls — first `cd`, then the command.
- **No inline env vars** — don't use `VAR=value command`. Set env separately or use proper auth tools.

## Git Auth

- Use `gh auth login` / `gh auth switch` to switch GitHub accounts — never prefix with `GH_TOKEN=...`.

## Why

Each chained command is one opaque action to the permission layer; splitting them gives one auditable tool call per intent. Inline env vars hide configuration in the command line and leak secrets into shell history; explicit auth tools (`gh auth login`) keep credentials in the keyring where they belong.

## Prerequisites

- A POSIX shell (bash or zsh).
- For the Git Auth rule: `gh` CLI installed and authenticated.

## Failure modes

- **`gh auth login` fails or token expired.** Re-run `gh auth login -h github.com` interactively, then `gh auth status` to verify. Don't paste the token into a shell command.
- **Account switch needed.** `gh auth switch -u `. If that user's token is invalid, re-auth that account before switching.
- **Command needs elevated privileges.** Set up the privilege out-of-band (sudoers entry, group membership) rather than prefixing the command with `sudo` inline; an unattended agent shouldn't be entering passwords.
- **Shell aliases that hide what runs.** Avoid invoking aliases in agent procedures; spell out the real command so it's auditable.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [swell-agents](https://github.com/swell-agents)
- **Source:** [swell-agents/coding-skills](https://github.com/swell-agents/coding-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-swell-agents-coding-skills-shell-discipline
- Seller: https://agentstack.voostack.com/s/swell-agents
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.