shell-scripting

A guide for writing Bash or Zsh scripts, which are command-line programs used to automate work on Unix-like systems.

In plain words
What is it for?
Use it to write or review shell scripts, command-line automation, file processing, and scripts that handle flags or failures.
Why use it?
It helps avoid fragile scripts by covering argument handling, errors, safe file operations, signals, and exit codes.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/alibaba/anolisa/shell-scripting
Any agent
npx skills add alibaba/anolisa --skill shell-scripting
Clone the repo
git clone --depth 1 https://github.com/alibaba/anolisa

Made for: Claude Code, Codex.

Per session 60 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,631 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00060 $0.03631
Opus 5 $0.00030 $0.01816
Sonnet 5 $0.00012 $0.00726
Haiku 4.5 $0.00006 $0.00363

Measured yesterday against content hash 824c89974b23, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

shell-scripting scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

rm -rf "$TMP_DIR"

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

require_cmd curl
src/os-skills/system-admin/shell-scripting/SKILL.md · 398 lines

How it starts

The opening of the file, as written. The whole thing — 398 lines — stays where its author put it; the contents beside it link to each section on GitHub.

When this skill is activated, always start your first response with the 🧢 emoji.

Shell Scripting

Shell scripting is the art of automating tasks through the Unix shell - combining built-in commands, control flow, and process management to build reliable CLI tools and automation workflows. This skill covers production-quality bash and zsh scripting: robust error handling, portable argument parsing, safe file operations, and the idioms that separate fragile one-liners from scripts that hold up in production.


When to use this skill

Trigger this skill when the user:

  • Asks to write or review a bash or zsh script
  • Needs to parse command-line arguments or flags
  • Wants to automate a CLI workflow or task runner
  • Asks about exit codes, signal trapping, or error handling in shell
  • Needs to process files, lines, or streams from the terminal
  • Asks about here documents, process substitution, or subshells
  • Wants a portable script that works across bash, zsh, and sh

Do NOT trigger this skill for:

  • Python or Node.js CLI tools (shell is the wrong tool for complex logic)
  • Scripts that require structured data parsing at scale (use a real language instead)

Key principles

  1. Always use set -euo pipefail - Start every non-trivial script with this. -e exits on error, -u treats unset variables as errors, -o pipefail catches failures in pipelines. Without this, silent failures hide bugs for weeks.
  2. Quote everything - Always double-quote variable expansions: "$var", "$@", "${array[@]}". Unquoted variables break on whitespace and glob characters. The only exceptions are intentional word splitting and arithmetic contexts.
  3. Check dependencies upfront - Verify required commands exist before the script runs. Fail fast at the top with a clear error, not halfway through a destructive operation.
  4. Use functions for reuse and readability - Extract logic into named functions. Shell functions support local variables (local), can return exit codes, and make scripts testable. A main() function at the bottom with a guard is idiomatic.
  5. Prefer shell built-ins over external commands - [[ ]] over [ ], ${var##*/} over basename, ${#str} over wc -c. Built-ins are faster, more portable, and avoid spawning subshells. Use printf over echo for reliable output formatting.

Read the full file on GitHub · 398 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 398 lines · 60 tokens per session scan C 824c89974b23

Subscribe to this mod's changes

shell-scripting is a skill published in the GitHub repository alibaba/anolisa (614 stars, last pushed 2d ago), licensed Apache-2.0. It adds 60 tokens to every session and 3,631 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

bash-scripting-safe

Write safe, robust Bash scripts — set -euo pipefail, quoting, word splitting, error handling, idempotency, and common data-loss gotchas.

vikasudasi/skill-vault · 38 tokens

shell-scripting

Skill "shell-scripting" from chaterm/terminal-skills, covering shell 脚本编写, 概述, 基础语法, 脚本结构 and 脚本描述.

chaterm/terminal-skills · 13 tokens

claude-api

Build, debug, and optimize Claude API / Anthropic SDK apps. Apps built with this skill should include prompt caching. Also handles migrating existing Claude API code between Claude model versions (4.5 → 4.6, 4.6 → 4.7, retired-model replacements). TRIGGER when: code imports anthropic/@anthropic-ai/sdk; user asks for…

warpdotdev/warp · 193 tokens

gui-onboarding-verification-skill

GUI desktop app only. Launch two parallel Oz cloud agents with computer use to download and install the latest stable Linux Warp build, capture screenshots while walking through first-time onboarding in both logged-out and logged-in states, then selectively fan out follow-up cloud agents for distinct onboarding…

warpdotdev/warp · 98 tokens

create-skill

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

warpdotdev/warp · 64 tokens

gui-integration-test

GUI desktop app only. Writes, runs, and debugs Warp integration tests using the custom Builder/TestStep framework in crates/integration. Use when adding a new integration test, fixing a failing integration test, wiring a test into the manual runner or nextest suite, or verifying end-to-end UI and terminal behavior in…

warpdotdev/warp · 72 tokens