shell-security

Provide POSIX shell security guidance for safe quoting and input handling.

Updated Dec 15, 2025

Search Tags:#input-validation #command-injection #quoting #shell-security #POSIX #portable-scripts

Ready to run

npx skills add https://github.com/scruffydan/AI-Agents --skill shell-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: shell-security
Source: https://github.com/scruffydan/AI-Agents/tree/main/source/skills/shell-security
Command: npx skills add https://github.com/scruffydan/AI-Agents --skill shell-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

POSIX shell scripting often suffers from quoting errors, word splitting, and command-injection risks. This Skill provides practical guidance to write secure shell scripts across POSIX-compatible shells, reducing vulnerabilities and hard-to-trace bugs.

Core Features & Use Cases

Safe quoting and parameter handling to prevent word splitting and glob expansion.
Secure command construction, substitution, and use of built-in commands over external tools.
Argument parsing safety and robust handling of user input to avoid injections and path traversal.
Secure file operations and portable scripting practices that work across sh, dash, and ash.

Quick Start

Review a shell script and apply the guidelines to fix unsafe quoting, improve input validation, and harden command execution.

Frequently Asked Questions about shell-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent command injection in POSIX shell scripts?▼

Prevent command injection in POSIX shell scripts by enforcing safe quoting, validating user input, and avoiding unsafe eval execution during command construction and parameter substitution.

What is the best way to handle word splitting and glob expansion in sh?▼

Handle word splitting and glob expansion in sh by using safe quoting practices for parameter handling, ensuring variables are properly enclosed to prevent unintended file pattern matching.

Does this shell security guidance work with dash and ash?▼

Yes, this shell security guidance works with dash and ash by providing portable scripting practices and secure file operations tailored for POSIX-compatible shells across system automation workflows.

How do I securely parse arguments and user input in portable scripts?▼

Securely parse arguments in portable scripts by applying robust input handling techniques to avoid injections and path traversal, using built-in commands over external tools for safer execution.

When should I avoid using eval in system automation scripts?▼

Avoid using eval in system automation scripts when processing untrusted user input, as it introduces command injection risks; use secure command construction and parameter substitution instead.

Why does my shell script fail from improper quoting across different shells?▼

Shell scripts fail from improper quoting across different shells due to word splitting and glob expansion; applying POSIX-compliant quoting and parameter handling prevents these hard-to-trace bugs.