Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/lugassawan/swe-workbench/language-bashnpx skills add lugassawan/swe-workbench --skill language-bashgit clone --depth 1 https://github.com/lugassawan/swe-workbenchWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lugassawan/swe-workbench/language-bash)<a href="https://agentmods.dev/skills/lugassawan/swe-workbench/language-bash"><img src="https://agentmods.dev/badge/skills/lugassawan/swe-workbench/language-bash.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00060 | $0.01809 |
| Opus 5 | $0.00030 | $0.00905 |
| Sonnet 5 | $0.00012 | $0.00362 |
| Haiku 4.5 | $0.00006 | $0.00181 |
Grade A, and why
language-bash scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bash
Strict mode
set -euo pipefail
IFS=$'\n\t'
-eis suppressed in conditional contexts (||,&&,if,!); explicit subshells(...)do inherit it — use|| trueto absorb expected failures.-utreats unset variables as errors; unset arrays trigger it: declare before use (arr=()) or guard with${arr[@]+"${arr[@]}"}for optional arrays.IFS=$'\n\t'prevents accidental word-splitting on spaces inforloops and command substitution.
Quoting and tests
- Always
"$var"— bare$vartriggers word splitting and glob expansion. 'literal'for fixed strings with no expansion needed.- Prefer
[[ ]]over[ ]: supports=~regex, no word splitting, lexical string comparison. $()over backticks: nestable, readable, no escaping required.
if [[ "$filename" =~ \.(sh|bash)$ ]]; then
shellcheck "$filename"
fi
Parameter expansion
${var:-default}— substitute default if unset or empty.${var:?error msg}— abort with message if unset; pairs well withset -u.${var%suffix}— strip shortest suffix match (e.g. strip extension).${var//pattern/repl}— replace all occurrences in-place.
Arrays and word splitting
files=(src/a.sh "src/b script.sh" src/c.sh)
for f in "${files[@]}"; do # each element quoted separately
process "$f"
done
"${arr[@]}"— each element as a separate quoted word; always use for iteration."${arr[*]}"— all elements joined byIFS[0]; use only for joining to a string.- Never
for x in $(cmd)— usemapfile -t arr < <(cmd)orwhile IFS= read -r line.
Pipelines and subshells
pipefailmakes a pipeline fail when any stage fails, not just the last.- Command substitution
$(...)runs in a subshell; variable assignments inside don't leak out. cmd || trueabsorbs an expected non-zero exit under-e;cmd 2>/dev/nullsuppresses stderr noise separately.- Background jobs:
proc &; alwayswait "$pid"before consuming results. - Redirect ordering matters:
cmd >/dev/null 2>&1silences all;cmd 2>&1 >/dev/nullsilences stdout only (stderr still shows — order determines what2>&1copies).
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 138 lines · 60 tokens per session scan A 932a1297a598
language-bash is a skill published in the GitHub repository lugassawan/swe-workbench (2 stars, last pushed yesterday), licensed MIT. It adds 60 tokens to every session and 1,809 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
ddd
Domain-Driven Design patterns for .NET — aggregates, value objects, strongly-typed IDs, domain events, repositories, and layer rules.
modern-csharp
C# 12–14 language features with practical patterns — primary constructors, collection expressions, records, pattern matching, nullable reference types, and more.
vertical-slice
Vertical Slice Architecture (VSA) for .NET APIs — feature-first folder structure, IEndpointGroup pattern, cross-cutting concerns, and testing approach.
aspnet-api-patterns
ASP.NET Core API patterns — controllers vs minimal API, middleware, error handling, versioning, and authentication setup.
clean-architecture
.NET clean architecture enforcement — layer rules, dependency direction, DI registration patterns, and project reference validation.
dotnet-project-init
Discovers .NET solution context — projects, frameworks, test runners, EF contexts, architecture style, and package management.