Skills linux-shell-scripting
📦
linux-shell-scripting
v1.1 Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Build Linux Shell Automation Scripts
Linux administrators need repeatable scripts for backups, monitoring, and maintenance. This skill provides Bash templates and guidance for common operational tasks.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "linux-shell-scripting" from https://skillstore.io/skills/sickn33-linux-shell-scripting.md and its manifest at https://skillstore.io/api/skills/sickn33-linux-shell-scripting/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "linux-shell-scripting". Request for a daily backup workflow with rotation.
Expected outcome:
A Bash script plan with configurable source paths, timestamped archives, retention limits, validation checks, and scheduling notes.
Using "linux-shell-scripting". Request for a Linux health report script.
Expected outcome:
A structured report workflow that captures uptime, load, memory, disk use, top processes, and a readable output file.
Using "linux-shell-scripting". Request for safe cleanup automation.
Expected outcome:
A maintenance script design with dry-run behavior, path restrictions, age filters, logging, and explicit confirmation before deletion.
Security Audit
Criticalv4 • 7/7/2026 Open versioned report
Most medium detections are Markdown code fences, inline examples, or normal Bash syntax, and those were dismissed as false positives. Confirmed risks remain where the skill teaches privileged package and service changes, user account and password-file inspection, cron or background persistence, destructive deletion, credential exposure, and remote script execution. No prompt-injection text was found in SKILL.md.
1
Files scanned
510
Lines analyzed
8
Review items
0
False positives ignored
Confirmed security concerns (12)
Critical
System password file access
for user in $(grep "/bin/bash" /etc/passwd | cut -d: -f1); do
The template reads /etc/passwd to enumerate local Bash users for a password expiry report. This exposes account inventory and is sensitive even when intended for administration.
High
Cron job modification
| `crontab -e` | Edit cron jobs |
The skill teaches cron editing and includes a cron setup template, enabling persistent scheduled execution. This is legitimate automation but a high-impact persistence mechanism.
High
[HEURISTIC] SUSPICIOUS COMBINATION: Code execution + Persistence mechanism
This combination is common in malware that maintains access
The skill combines shell-script templates with cron and background execution patterns. There is no evidence of stealth or exfiltration, but the combination can support persistent execution if misused.
High
Destructive File Deletion Template
The cleanup template accepts a directory and age value, then deletes matching files with rm. It lacks a dry-run mode, path allowlist, confirmation, or protection against accidental broad deletion.
The template contains a direct find command that executes rm against a user-selected directory. The missing safeguards make the destructive behavior high confidence.
High
Remote Script Execution Template
The remote execution template sends a local script to a remote host over SSH and runs it with Bash. This is high impact if the remote host or script path is untrusted or user-controlled.
The template explicitly executes a script on a remote server from configurable parameters. That is a clear remote execution capability, even though it can be legitimate.
High
Unvalidated Privileged Service Control
The service restart template accepts a service name argument and passes it to sudo systemctl start or restart. Without allowlisting, a user can target sensitive services for privileged changes.
The service name is argument-controlled and used in privileged systemctl commands. The static sudo finding catches privilege use, but this adds the missing input-control context.
Medium
Plaintext Credential Handling in Database Backup Template
The database backup template sets a db_pass variable and passes the password on the mysqldump command line. Users may copy this pattern and expose database credentials through process listings or saved scripts.
The template directly includes a password variable and uses it in a command argument. The value is a placeholder, but the pattern encourages unsafe credential handling.
Medium
Generated Password Printed to Output
The password generator prints the generated password to standard output. This can expose secrets in terminal scrollback, logs, shared transcripts, or monitoring tools.
The script assigns a generated password and immediately echoes it. The risk depends on where output is captured, but the exposure path is clear.
Show all 12 confirmed findings
Low
System reconnaissance
output_file="system_info_$(hostname)_$(date +%Y%m%d).txt"
The system information template records host identity and operating-system details. This is useful for administration but can disclose reconnaissance data if the report is mishandled.
Low
System reconnaissance
echo "Hostname: $(hostname)"
The system information template records host identity and operating-system details. This is useful for administration but can disclose reconnaissance data if the report is mishandled.
Low
System reconnaissance
echo "OS: $(uname -a)"
The system information template records host identity and operating-system details. This is useful for administration but can disclose reconnaissance data if the report is mishandled.
Low
Network reconnaissance
ip addr show "$interface" 2>/dev/null || ifconfig "$interface" 2>/dev/null
The network interface script enumerates local interface and route data. This is legitimate administration, but it can reveal network topology information.
Capability review items (8)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Shell command substitution
for user in $(grep "/bin/bash" /etc/passwd | cut -d: -f1); do
The substitution reads /etc/passwd to enumerate local shell users. Even in an admin template, that account inventory is sensitive and can support reconnaissance.
High
Shell command substitution
password_expires=$(chage -l "$user" 2>/dev/null | grep "Password expires" | awk -F: '{print $2}')
The substitution runs chage for each discovered user and writes password expiry metadata to a report. This exposes account policy information and requires careful authorization.
High
Unix shell invocation
useradd -m -s /bin/bash "$username"
The template creates a local operating-system account with a Bash shell, which changes identity state and normally requires elevated privileges. This is legitimate administration, but it is high impact if copied without safeguards.
High
Unix shell invocation
for user in $(grep "/bin/bash" /etc/passwd | cut -d: -f1); do
The command enumerates Bash users from /etc/passwd as part of a password-expiry report. That exposes local account inventory and should be treated as sensitive system inspection.
High
sudo privilege escalation
sudo apt-get install -y "$package"
The template invokes sudo to install packages or control services, which changes host state with elevated privileges. These actions need explicit review and least-privilege controls.
High
sudo privilege escalation
sudo systemctl restart "$service_name"
The template invokes sudo to install packages or control services, which changes host state with elevated privileges. These actions need explicit review and least-privilege controls.
High
sudo privilege escalation
sudo systemctl start "$service_name"
The template invokes sudo to install packages or control services, which changes host state with elevated privileges. These actions need explicit review and least-privilege controls.
Medium
nohup (background persistent process)
| `nohup ./script.sh &` | Run in background |
The quick reference teaches nohup with background execution, which can keep processes running after a session ends. It is a normal admin pattern but can be abused for persistence.
Risk Factors
⚙️ External commands (135)
SKILL.md:41-49 SKILL.md:49-52 SKILL.md:52-60 SKILL.md:60-63 SKILL.md:63-75 SKILL.md:75-78 SKILL.md:78-89 SKILL.md:89-94 SKILL.md:94-106 SKILL.md:106-109 SKILL.md:109-121 SKILL.md:121-124 SKILL.md:124-133 SKILL.md:133-136 SKILL.md:136-162 SKILL.md:162-167 SKILL.md:167-181 SKILL.md:181-184 SKILL.md:184-200 SKILL.md:200-205 SKILL.md:205-212 SKILL.md:212-215 SKILL.md:215-235 SKILL.md:235-240 SKILL.md:240-249 SKILL.md:249-252 SKILL.md:252-267 SKILL.md:267-272 SKILL.md:272-286 SKILL.md:286-289 SKILL.md:289-303 SKILL.md:303-306 SKILL.md:306-316 SKILL.md:316-321 SKILL.md:321-337 SKILL.md:337-340 SKILL.md:340-348 SKILL.md:348-351 SKILL.md:351-365 SKILL.md:365-370 SKILL.md:370-378 SKILL.md:378-381 SKILL.md:381-391 SKILL.md:391-394 SKILL.md:394-406 SKILL.md:406-411 SKILL.md:411-440 SKILL.md:440-445 SKILL.md:445-462 SKILL.md:462-465 SKILL.md:465-473 SKILL.md:473-481 SKILL.md:481-482 SKILL.md:482-483 SKILL.md:483-484 SKILL.md:484-485 SKILL.md:485-491 SKILL.md:491-492 SKILL.md:492-493 SKILL.md:493-494 SKILL.md:494-495 SKILL.md:495-506 SKILL.md:47 SKILL.md:48 SKILL.md:69 SKILL.md:70 SKILL.md:83 SKILL.md:99 SKILL.md:115 SKILL.md:129 SKILL.md:130 SKILL.md:142 SKILL.md:189 SKILL.md:193 SKILL.md:194 SKILL.md:210 SKILL.md:243 SKILL.md:248 SKILL.md:294 SKILL.md:413 SKILL.md:417 SKILL.md:420 SKILL.md:421 SKILL.md:454 SKILL.md:482 SKILL.md:483 SKILL.md:41-49 SKILL.md:63-75 SKILL.md:78-89 SKILL.md:94-106 SKILL.md:109-121 SKILL.md:124-133 SKILL.md:136-162 SKILL.md:184-200 SKILL.md:205-212 SKILL.md:240-249 SKILL.md:289-303 SKILL.md:411-440 SKILL.md:445-462 SKILL.md:482 SKILL.md:483 SKILL.md:42 SKILL.md:53 SKILL.md:64 SKILL.md:79 SKILL.md:95 SKILL.md:110 SKILL.md:125 SKILL.md:137 SKILL.md:168 SKILL.md:175 SKILL.md:185 SKILL.md:193 SKILL.md:206 SKILL.md:216 SKILL.md:241 SKILL.md:253 SKILL.md:273 SKILL.md:290 SKILL.md:307 SKILL.md:322 SKILL.md:341 SKILL.md:352 SKILL.md:371 SKILL.md:382 SKILL.md:395 SKILL.md:412 SKILL.md:446 SKILL.md:466 SKILL.md:481 SKILL.md:493 SKILL.md:331 SKILL.md:358 SKILL.md:362 SKILL.md:505
🌐 Network access (2)
📁 Filesystem access (10)
Detected Patterns
System password file accessCron job modificationSystem reconnaissance×3Network reconnaissance
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-linux-shell-scripting/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-linux-shell-scripting?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-linux-shell-scripting?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-linux-shell-scripting/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-linux-shell-scripting.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). linux-shell-scripting security audit report (audit version 4) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-linux-shell-scripting/audits/4BibTeX citation
@techreport{sickn33-sickn33-linux-shell-scripting-2026,
author = {sickn33},
title = {linux-shell-scripting security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-linux-shell-scripting/audits/4},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "linux-shell-scripting security audit report (audit version 4)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-linux-shell-scripting/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-linux-shell-scripting:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
87
Spec Compliance
What You Can Build
Automate Backups
Create repeatable backup and rotation scripts for application files or databases.
Monitor Linux Hosts
Generate scripts that report CPU, disk, uptime, users, and service status.
Review Operational Logs
Build scripts that summarize error logs, web requests, and network status for authorized systems.
Try These Prompts
Create a Backup Script
Create a Bash script that backs up one directory to another directory with a timestamped archive. Include simple validation and clear status messages.
Add Monitoring Alerts
Create a Bash script that checks CPU and disk usage on a Linux host. Add thresholds, readable output, and a place for notification logic.
Analyze Logs Safely
Create a Bash script that summarizes recent error entries from a system log. Include input validation, output file naming, and permission notes.
Design Production Automation
Design a production-ready Bash maintenance script for backups, cleanup, and service checks. Include dry-run mode, logging, safeguards, and rollback notes.
Best Practices
- Test every generated script in a non-production environment first.
- Use least privilege, explicit paths, quoted variables, and clear logging.
- Add dry-run modes and confirmations before destructive or privileged actions.
Avoid
- Running generated scripts as root without reviewing each command.
- Embedding plaintext passwords or tokens directly in shell scripts.
- Scheduling cron jobs or deletion tasks without logging and rollback plans.
Frequently Asked Questions
Can this skill run shell commands automatically?
No. It provides templates and guidance. Users must review and run scripts in their own environment.
Does it support non-Linux systems?
It targets Linux and Unix-style Bash environments. Some commands may need changes on macOS or BSD systems.
Are the templates production ready?
They are starting points for production scripts. Add environment-specific validation, logging, rollback, and access controls.
Can it help with backups and retention?
Yes. It includes examples for archive creation, remote backup, database dump workflows, and backup rotation.
How should privileged commands be handled?
Review every privileged command, use least privilege, and require explicit approval before changing packages, services, users, or schedules.
Is it useful with Claude, Codex, and Claude Code?
Yes. The skill can guide Claude, Codex, and Claude Code when drafting Linux Bash automation tasks.
Developer Details
Author
sickn33License
MIT
Author version
v1.1
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/linux-shell-scriptingRef
816c62b2546ddb1c6a0453e7c781b5e095117819
Maintenance freshness
7/18/2026
Usage
12 downloads · 140 views
File structure
📄 SKILL.md