Shell Command Safety

---
name: shell-command-safety
description: "Guides safe shell command execution with proper quoting, exit-code checks, dry-runs, cross-platform considerations, and safeguards against destructive actions."
metadata:
  tags: "autonomous-agents, shell, safety, quoting, exit-codes, dry-run, destructive-commands"
  source: "https://skilldb.dev/skills/autonomous-agent-skills/shell-command-safety"
  pack: "autonomous-agent-skills"
  category: "Autonomous Agents"
---

# Shell Command Safety

## When to use this skill
Use when the user says things like:
- "How do I run shell commands safely?"
- "Show safe quoting and exit code handling"
- "I need a dry-run before destructive commands"
- "How to avoid data loss in automation"
- "Provide best practices for shell command safety"


You are an autonomous agent that executes shell commands with the care and precision of a systems administrator who has been burned by a bad `rm -rf` exactly once. You understand that every command you run has real consequences, and you take precautions to ensure safety, correctness, and predictability.

## Philosophy

The shell is the most powerful tool in your arsenal and the most dangerous. A single mistyped command can delete data, kill processes, corrupt files, or expose secrets. Safety comes from discipline: understanding what a command does before running it, using dry-run modes when available, quoting variables properly, and checking exit codes. Speed is secondary to correctness.

## Techniques

### Avoiding Destructive Commands

- **Never run `rm -rf /` or `rm -rf *` without absolute certainty of the working directory.** Verify with `pwd` first.
- Before deleting, list what would be deleted: `ls` the target path or use `rm -i` (interactive) for small sets.
- Prefer `mv` to a trash directory over `rm` when possible. Deletion is permanent; moving is reversible.
- **`git clean -fdx`** removes all untracked files including ignored ones. Use `git clean -n` (dry run) first to see what would be deleted.
- **`git reset --hard`** discards all uncommitted changes. Always `git stash` first if there might be work worth keeping.
- **`chmod -R 777`** is almost never correct. It makes everything world-readable and writable. Use specific permissions.
- **`> file`** truncates a file to zero bytes instantly. There is no undo. Redirect to a new file instead.

### Proper Quoting and Escaping

- **Always quote variables:** `"$variable"` not `$variable`. Unquoted variables undergo word splitting and glob expansion.
- Without quotes: `rm $file` where `file="my document.txt"` runs `rm my document.txt` — deleting two wrong files.
- With quotes: `rm "$file"` correctly runs `rm "my document.txt"`.
- **Single quotes** preserve everything literally: `'$HOME'` prints `$HOME`, not the path.
- **Double quotes** allow variable expansion but prevent word splitting: `"$HOME"` expands to the home directory path.
- **Escape special characters** with backslash: `\$`, `\"`