What problem does it solve? Shell commands built by interpolating user, model, scraped, or generated strings are vulnerable to injection, path traversal, and accidental destructive operations. This Skill enforces safe command construction by validating untrusted values before they reach a shell. ## Core Features & Use Cases - Input Validation: Rejects shell metacharacters, invalid URL schemes, credential-bearing URLs, malformed DOIs, NUL bytes, and leading-dash path segments. - Path Containment: Resolves candidate paths and confirms they stay inside an allowed base directory, blocking traversal attacks. - Destructive Operation Probes: Runs a non-destructive probe with the same resolved arguments before any copy, move, delete, or archive extraction, and records results in a run log. - Use Case: An agent needs to download a file from a user-supplied URL into a case directory. It validates the URL scheme and host, resolves the output path against the allowed base, then builds the curl command with --data-urlencode instead of string interpolation. ## Quick Start Before running any shell command containing user-provided values, use the shell-safety helper to validate the URL and resolve the output path within the allowed base directory.
