Shell Conventions and Scripting Guidelines

VerifiedSafe

Guides writing and updating bash scripts, CLI wrappers, and Node.js helper scripts. Emphasizes portability, strict mode, and safe argument handling.

Sby Skills Guide Bot
DevelopmentBeginner
7/28/2026
Claude CodeCursorWindsurfCopilotCodex
#bash#shell-scripts#cli-wrappers#strict-mode#portability

Recommended for

Automated summary

Describes conventions for writing and updating bash scripts, CLI wrappers, and Node.js helper scripts in the scripts/ folder.

Strengths

  • Enforces a portable shebang and strict mode (`set -euo pipefail`) to avoid silent failures.
  • Gives concrete patterns for script-relative path resolution and `trap`-based cleanup.
  • Covers safe argument defaults and avoids `eval` or raw string interpolation in command execution.
  • Includes TypeScript ESM guidance requiring explicit `.js` extensions.

Limitations

  • Scoped to `scripts/` and helper utilities; it does not cover application CLI commands or tests.
  • Assumes a bash environment with tools such as `pnpm`, `npx`, or `vitest`.
  • Does not address Windows/PowerShell equivalents.
When to use it

Use when creating or updating a bash script, CLI wrapper, or Node.js helper script under `scripts/`.

When not to use it

Do not use for Commander CLI commands in `src/commands/`, test files, or non-bash scripts.

Security analysis

Safe
Quality score90/100

The skill provides standard shell scripting conventions and safety practices. It recommends strict mode, safe path resolution, argument defaults, and cleanup traps. The only destructive command is removing a script-created mktemp directory, and there is no exfiltration, obfuscation, or unsafe remote execution.

No concerns found

How this analysis is made

Examples

Coverage wrapper script
Create scripts/run-coverage.sh that runs Vitest coverage for the suite passed as the first argument (default: scoring), uses `#!/usr/bin/env bash`, `set -euo pipefail`, resolves the project root from the script location, and is executable.
Review release script
Review scripts/release.sh for shell portability: ensure it uses `#!/usr/bin/env bash` and `set -euo pipefail`, resolves paths via SCRIPT_DIR/PROJECT_ROOT, provides defaults for optional arguments, and cleans up temporary files with a trap.
Safe Node helper
Write a Node.js TypeScript helper in scripts/ that invokes an external command using an argument array instead of `eval` or `child_process.exec`, and use ESM imports with explicit `.js` extensions.

name: shell-conventions description: Guides writing and updating bash scripts, CLI wrappers, and Node.js-based helper scripts. Use this when modifying scripts in the scripts/ folder, writing release utilities, or executing command-line processes. Do NOT use for standard Commander CLI commands inside src/commands/ or test files.

Shell Conventions and Coding Guidelines

Critical

  • Portability and Strict Mode: All bash scripts must use #!/usr/bin/env bash as their shebang (never #!/bin/bash or #!/bin/sh) and immediately enable strict mode with set -euo pipefail.
  • TypeScript ESM Imports: Any TypeScript scripts executed in the scripts context (such as tsdown compiled files) must use ESM imports with explicit .js extensions (e.g. import { x } from './x.js';).
  • No Unsafe Evaluations: Avoid using eval or executing raw string interpolations in bash or Node's child_process.exec. Use safe argument arrays or library execution helpers like unrun where appropriate.

Instructions

  1. Set Up the Script Environment:
    • Create the target shell script in the scripts/ directory.
    • Add the strict mode header:
      #!/usr/bin/env bash
      set -euo pipefail
      
    • Verify that the script has execute permissions (chmod +x scripts/filename.sh).
  2. Resolve Paths Relativistically:
    • Determine the script directory relative to the project root to ensure robustness regardless of execution directory:
      SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
      PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
      
    • Verify that all relative paths used in commands (e.g., pnpm run, vitest) are correctly absolute or relative to PROJECT_ROOT.
  3. Handle Arguments and Flags Safely:
    • Use standard parameter expansion for default values to prevent "unbound variable" errors under set -u:
      ENV_TARGET="${1:-dev}"
      
    • Verify behavior by executing the script with and without arguments.
  4. Implement Clean Up Traps:
    • Use shell trap definitions to clean up temporary files or background processes on exit:
      TMP_DIR=$(mktemp -d)
      cleanup() {
        rm -rf "$TMP_DIR"
      }
      trap cleanup EXIT
      
    • Verify cleanup by sending a SIGINT (Ctrl+C) or causing a deliberate command failure, ensuring the cleanup routine runs.

Examples

Example 1: Creating a test wrapper script

User says: "I want a script to run specific Vitest suites with coverage" Actions taken:

  1. Create scripts/run-coverage.sh with the following contents:
    #!/usr/bin/env bash
    set -euo pipefail
    
    SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
    PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
    
    cd "$PROJECT_ROOT"
    
    SUITE="${1:-scoring}"
    echo "Running Vitest coverage for suite: $SUITE"
    npx vitest run --coverage "tests/$SUITE"
    
  2. Run chmod +x scripts/run-coverage.sh.
  3. Verify execution by running ./scripts/run-coverage.sh scoring. Result: An executable, portable shell wrapper that follows strict execution principles.

Common Issues

  • Error: "...: unbound variable":
    • Fix: You are accessing a parameter or environment variable that is not set. Provide a fallback default value using ${VAR:-default} or check if it is set first.
  • Error: "No such file or directory" when referencing paths:
    • Fix: Ensure you are changing directory to the project root or utilizing an absolute script directory calculation (e.g. cd "$(dirname "${BASH_SOURCE[0]}")").
  • Error: ESM Module resolution failure in TS script runner:
    • Fix: Check imports in scripts. In TypeScript scripts running under node, imports must contain explicit .js extensions, even when importing a .ts file.

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/shell-conventions-and-scripting-guidelines-ms47vq8j/download' --output '.skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j/SKILL.md.part' && mv '.skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j/SKILL.md.part' '.skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.

Claude Code
test -f '.skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j/SKILL.md' && test -s '.skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/shell-conventions' && cp -R '.skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j' '.claude/skills/shell-conventions'

Cursor
test -f '.skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j/SKILL.md' && test -s '.skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j/SKILL.md' && mkdir -p '.cursor/skills' && test ! -e '.cursor/skills/shell-conventions' && cp -R '.skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j' '.cursor/skills/shell-conventions'

Codex
test -f '.skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j/SKILL.md' && test -s '.skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j/SKILL.md' && mkdir -p '.agents/skills' && test ! -e '.agents/skills/shell-conventions' && cp -R '.skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j' '.agents/skills/shell-conventions'

OpenSkills

OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.

Official OpenSkills installation
openskills install './.skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j'

openskills read 'shell-conventions-and-scripting-guidelines-ms47vq8j'

Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.

For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.

openskills sync

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/shell-conventions-and-scripting-guidelines-ms47vq8j/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills