safe-shell-ops

Prevents shell quoting, heredoc, and generated-file mistakes during command execution.

Updated Apr 14, 2026
One-click install
npx skills add https://github.com/amitkarpe/agent-skills --skill safe-shell-ops-amitkarpe
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: safe-shell-ops
Source: https://github.com/amitkarpe/agent-skills/tree/main/skills/safe-shell-ops
Command: npx skills add https://github.com/amitkarpe/agent-skills --skill safe-shell-ops-amitkarpe

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Shell operations frequently fail due to quoting errors, heredoc expansion, word splitting, and interpreter-boundary mismatches, especially when generating files or remote scripts. This Skill provides decision rules and validation steps that prevent these failures before they happen. ## Core Features & Use Cases - Safe File Generation: Routes file edits through apply_patch or validated temp scripts instead of fragile inline heredocs, protecting Markdown with backticks and dollar signs. - Script Validation Workflow: Enforces bash -n or zsh -n syntax checks on generated scripts before execution, plus git diff --check before commits. - Remote Shell Boundary Handling: Separates POSIX-safe outer wrappers from staged Bash inner scripts for SSM RunShellScript, cloud-init, CI, and SSH payloads, with checksum and dual-layer syntax validation. - Use Case: When generating an SSM RunShellScript payload containing Bash arrays and process substitution, this Skill ensures the outer wrapper stays POSIX-safe and the inner script is validated with /usr/bin/bash -n before execution. ## Quick Start Use the safe-shell-ops skill before writing this deployment script through the shell to make sure quoting and heredoc handling are correct.

Frequently Asked Questions about safe-shell-ops

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely write files with shell heredocs?▼

Prefer apply_patch for file edits instead of inline heredocs. If a heredoc is truly needed, quote the delimiter in the shell that receives it (<<'EOF') and never nest a quoted heredoc inside an outer single-quoted bash -lc string.

How to generate Markdown files containing backticks or dollar signs?▼

Use apply_patch rather than bash -lc with cat heredocs, since backticks and $VAR trigger command substitution and expansion. After writing, read the file back to confirm the shell-sensitive characters survived intact.

Why does my SSM RunShellScript fail with Bash syntax?▼

SSM and similar remote wrappers may parse payloads with /bin/sh, not Bash, so arrays, [[ ]], and process substitution fail. Keep the outer wrapper POSIX-safe, stage the Bash script separately, and validate both layers with sh -n and bash -n.

When should I validate generated shell scripts?▼

Run bash -n or zsh -n on every edited or generated script before executing it. For low-risk local Markdown or notes edits, skip validation unless committing, pushing, or the content contains shell-sensitive characters.

Can I pass dynamic values into jq programs safely?▼

Pass dynamic values with jq --arg for strings or --argjson for JSON data instead of interpolating them into the jq program string. Interpolation breaks on special characters and creates injection-style quoting bugs.