Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fabioc-aloha/Alex_Skill_Mall --skill terminal-command-safetygit clone --depth 1 https://github.com/fabioc-aloha/Alex_Skill_MallWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fabioc-aloha/alex_skill_mall/terminal-command-safety)<a href="https://agentmods.dev/skills/fabioc-aloha/alex_skill_mall/terminal-command-safety"><img src="https://agentmods.dev/badge/skills/fabioc-aloha/alex_skill_mall/terminal-command-safety/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fabioc-aloha/alex_skill_mall/terminal-command-safety"><img src="https://agentmods.dev/badge/skills/fabioc-aloha/alex_skill_mall/terminal-command-safety.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00020 | $0.00881 |
| Opus 5 | $0.00010 | $0.00441 |
| Sonnet 5 | $0.00004 | $0.00176 |
| Haiku 4.5 | $0.00002 | $0.00088 |
Grade C, and why
terminal-command-safety scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf (not rm -ri) Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl --max-time 30 --connect-timeout 10 $url How it starts
The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Terminal Command Safety
Detailed patterns and examples for safe terminal command execution in AI agent contexts.
Decision Table
| Content Type | Safe Approach | Why |
|---|---|---|
| Contains backticks | Use temp file | Backticks break in all shells |
| Multi-line text | Use temp file | Heredocs can desync terminal |
| Both quote types | Use temp file | Can't escape both cleanly |
Dollar signs ($) |
Single-quoted heredoc or temp file | Prevents interpolation |
| Plain text only | Inline is safe | No shell metacharacters |
| Long-running (>15s) | mode=async |
Prevents timeout |
| Interactive prompt | Pre-answer with flags | --yes, --no-edit |
| Needs full output | Redirect to file, then read | Output can be truncated |
Backtick Hazard — Details
Backticks in terminal command arguments break across all shells:
- bash/zsh: backtick = command substitution (
echo "uselshere"executesls) - PowerShell: backtick = escape character (
echo "usen here"` inserts newline)
Ref: vscode#295620
Safe Pattern (bash)
# Write content to temp file (single-quoted delimiter prevents interpolation)
cat > /tmp/body.md << 'EOF'
## Changes
- Added `MyClass` to the module
- Updated `config.py`
EOF
# Pass file to command
gh pr create --title "My PR" --body-file /tmp/body.md
rm /tmp/body.md
Safe Pattern (PowerShell)
$body = @'
## Changes
- Added `MyClass` to the module
'@
$body | Out-File -Encoding utf8 "$env:TEMP\body.md"
gh pr create --title "My PR" --body-file "$env:TEMP\body.md"
Remove-Item "$env:TEMP\body.md"
Output Capture — Examples
Refs: vscode#308610, vscode#308048, vscode#307173
Redirect to file
npm run build 2>&1 | Out-File -Encoding utf8 "$env:TEMP\build-output.txt"
Get-Content "$env:TEMP\build-output.txt" -Tail 50
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 116 lines · 20 tokens per session scan C e635ac02c343
terminal-command-safety is a skill published in the GitHub repository fabioc-aloha/Alex_Skill_Mall (4 stars, last pushed yesterday), licensed MIT. It adds 20 tokens to every session and 881 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
apply-trust-building
Use when a manager is new to a team, has experienced a trust breach, or wants to deliberately strengthen the trust foundation of their management relationships — because trust determines whether employees share real problems, follow direction with confidence, and engage fully.
design-team-meeting-structure
Use when a team's meetings feel like the wrong type of conversation for the decisions being made, when meetings are too frequent or too infrequent, or when team members feel their time is wasted — to design the right meeting types, cadences, and facilitation practices for how the team actually works.
prevent-employee-burnout
Use when a manager wants to reduce the risk of burnout on their team, or when they observe signs that a direct report may be approaching burnout — to identify contributing factors and intervene before the employee becomes disengaged, impaired, or leaves.
run-underperformance-conversation
Use when a manager first observes that a direct report's performance is declining or falling below expectations — to have an early, direct, non-punitive conversation that names the gap and opens a path to correction before the situation requires formal process.
apply-distributed-team-practices
Use when managing a team where members work in different locations, time zones, or on hybrid schedules — to adapt management practices so remote members have equal access to information, relationships, and advancement opportunities as in-office members.
give-employee-recognition
Use when a manager wants to acknowledge a direct report's specific contribution, achievement, or behavior in a way that reinforces it and builds engagement — separate from compensation and formal performance reviews.