Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/TazWake/PublicWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/tazwake/public/shell-scripts)<a href="https://agentmods.dev/rules/tazwake/public/shell-scripts"><img src="https://agentmods.dev/badge/rules/tazwake/public/shell-scripts/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/tazwake/public/shell-scripts"><img src="https://agentmods.dev/badge/rules/tazwake/public/shell-scripts.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00639 |
| Opus 5.5 | $0.00000 | $0.00256 |
| Sonnet 5.5 | $0.00000 | $0.00128 |
| Haiku 4.5 | $0.00000 | $0.00064 |
Grade B, and why
shell-scripts scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- Principle of Least Privilege: Scripts should be designed to run with the minimum necessary privileges. Avoid sudo unless absolutely required, and if so, limit its use to specific commands. What it actually says
- Follow these rules unless an instruction explicitly contradicts them.
- If you are unsure as to whether or not the rule applies, as questions to get clarity.
- When writing bash scripts include help output and comments to inform users as to why things are being done the way they are.
- Error Handling and Strict Mode: Begin every script with set -euo pipefail. This ensures the script exits immediately if a command fails (-e), a variable is used without being set (-u), and a command in a pipeline fails (-o pipefail).
- Input Validation: Always validate and sanitize user input. Don't trust any input. Use regular expressions to check for expected patterns and escape or filter out potentially dangerous characters to prevent command injection.
- Principle of Least Privilege: Scripts should be designed to run with the minimum necessary privileges. Avoid sudo unless absolutely required, and if so, limit its use to specific commands.
- Avoid Hardcoding: Never hardcode sensitive information like passwords, API keys, or IP addresses directly in the script. Use environment variables, configuration files with strict permissions, or secure vaults.
- Use Full Paths: Use the full, absolute path for all commands (e.g., /usr/bin/nmap instead of nmap). This prevents path manipulation attacks and ensures the correct command is executed.
- Quote Variables: Always use double quotes around variables (e.g., "$variable") to prevent word splitting and globbing, which can lead to unexpected behavior and security vulnerabilities.
- Leverage Functions: Break down complex tasks into smaller, reusable functions. This makes the code more readable, maintainable, and easier to debug. Use local for variables within functions to prevent namespace pollution.
- Descriptive Naming: Use clear, descriptive names for variables and functions. Avoid single-letter variable names.
- Add Comments: Include comments to explain complex logic, unexpected behavior, or the purpose of a specific section of code. Commenting should explain the "why," not just the "what."
- Graceful Error Messages: Include clear, human-readable error messages. If a script fails, it should provide a concise explanation of what went wrong and how to fix it, guiding the user towards a resolution.
- Modular Design: When appropriate, use modular design principles. A script that performs multiple, distinct functions should be split into smaller, single-purpose scripts.
- Version Control: Include a version or Changelog header. This helps track updates and changes, which is vital in a team environment.
- Integrate Static Analysis: For larger or more critical scripts, advise the user to run a static analysis tool like ShellCheck to identify potential bugs and security issues before deployment.
- Handle Exit Codes: Explicitly check the exit status of commands using if [ $? -ne 0 ] to ensure critical commands executed successfully. This provides a fine-grained approach to error handling beyond the set -e option.
- Log Activity: Scripts should be designed to log their actions to a file or standard output. This is crucial for forensic analysis, incident response, and general auditing within a SOC environment.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 23 lines · 639 tokens per session scan B b2728452db73
shell-scripts is a cursor rule published in the GitHub repository TazWake/Public (46 stars, last pushed 1mo ago), licensed CC0-1.0. It costs nothing until one of its globs matches a file; then it loads 639 tokens. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
golang-always
Embedded Go skill routing rules — applies to every Go file in the project.
cursor-go-skills
Load the Go skills orchestrator before any Go task.
typescript-conventions
TypeScript coding conventions and style guidelines.
bundling
The project uses a custom type bundling system to provide full TypeScript IntelliSense support in the Monaco editor for @bubblelab/bubble-core and its dependencies. This is necessary because Monaco cannot directly resolve workspace packages or external dependencies.
uv
Install Python packages, access Python CLI, run python code and scripts, execute Python commands, and manage Python environments. Use uv run for all Python execution instead of direct python commands.
fastapi-pydantic
You are an expert in Python, FastAPI, and scalable API development.