Clean shell
Some of my Agents & Skills, compatible with most AI coding tools
npx -y skills add uwuclxdy/agenticat --skill clean-shellAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 5 stars5 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Defensive Bash/POSIX shell quality: strict-mode `set` flags, traps, idempotent mutation of live systems (deploy, sshd/sudoers, systemd), ShellCheck discipline, bats-core tests. Use when writing, hardening, reviewing, or testing shell scripts, or wiring shellcheck/bats into CI.
SKILL.md
2.0 KB, as published. Nobody here has run it
Clean Shell
Shell-specific conventions for writing, hardening, reviewing, and testing scripts. The core rules below always apply. Load the one reference file matching the task; don't load them all.
| Task touches | File |
|---|---|
| Scripts that mutate live systems: deploy/apply, firewall/sshd/sudoers edits, systemd oneshot+timer units, ssh remote-exec, rollback, cleanup traps, idempotency | references/defensive.md |
.shellcheckrc, # shellcheck disable= directives, severity floors, exit codes, CI gating | references/shellcheck.md |
Bats tests: .bats files, run, setup/teardown, PATH-stub mocking, parallel jobs | references/bats.md |
Core Rules
- Pick
setflags by intent and comment the reason next to them:set -euo pipefailfor orchestration where any failure aborts; drop-ewhen steps may fail without aborting;set -ualone for long-running loops. A thin wrapper sets no flags and ends withexec. - Quote every expansion (
"$var","${arr[@]}","$(cmd)");--end-of-options guard before untrusted operands. - Validate input at the boundary into a checked value (
"${1:?msg}", acaseinteger guard); no call site re-tests a raw string. - Every
mktempgets an EXIT trap right after creation. Traps are best-effort: SIGKILL, OOM-kill, and power loss skip them. - Anything that mutates system state is check-then-act idempotent; add
flockwhere concurrent runs are possible. - Never echo a generated secret;
set -xtracing andps//proc/*/cmdlineargv leak it too. - Every
# shellcheck disable=carries a same-line reason comment. - Non-trivial scripts get bats tests covering the error paths, not just the happy path.