The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading the official ShellCheck binary from GitHub and installing it via common package managers.
Evidence: Downloads stable binaries from github.com/koalaman/shellcheck.
Evidence: References package installation commands for apt, brew, apk, choco, and pip (for pre-commit).
[COMMAND_EXECUTION]: The skill contains various shell commands and scripts intended for CI/CD pipelines (GitHub Actions, Azure DevOps) and local hooks.
Evidence: Examples include find, tar, cp, and execution of the shellcheck CLI tool itself.
[PRIVILEGE_ESCALATION]: Standard installation instructions include commands that require elevated permissions.
Evidence: Uses sudo cp to move the ShellCheck binary to /usr/local/bin/ and chmod +x to set execution bits on git hooks.
[DYNAMIC_EXECUTION]: The documentation references the eval command while explaining ShellCheck rule SC2294, highlighting it as a practice to avoid in favor of safer array handling.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the automated processing of shell scripts in repository environments.
Ingestion points: Reads and analyzes .sh files in the repository (SKILL.md).
Boundary markers: Not explicitly defined in templates, though the tool serves as a validator.
Capability inventory: Shell execution via shellcheck command across various environments.
Sanitization: The skill specifically focuses on teaching secure shell practices, such as proper variable quoting (SC2086) and avoiding unsafe command substitution (SC2046), which mitigate common injection vulnerabilities in scripts.

shellcheck-cicd-2025