Read Only Shell Guard

Read Only Shell Guard

Overview

Not every harmless-looking command is actually read-only. This skill follows the guardrails in src/tools/BashTool/readOnlyValidation.ts and related shell validation utilities.

Read-Only Means

A read-only command may inspect state, but it must not:

• modify files
• create files
• redirect output into files
• invoke write-capable git flows
• change system state

Safe Categories

Usually safe when validated:

• rg, grep, find, cat, head, tail, wc, stat
• read-only git queries
• read-only gh queries
• filtered inspection commands with safe flags

Automatic Red Flags

Treat the command as non-read-only when you see:

• output redirection
• file creation or mutation
• mixed cd and git compound commands in sandboxed contexts
• git operations outside the original cwd when sandbox rules depend on cwd
• writes into git-internal paths
• UNC path or traversal risk
• shell parse failure

Compound Command Rule

The whole command is only read-only if every subcommand is read-only.

One unsafe segment makes the batch unsafe.

Validation Rule

Do not trust the command's story. Validate:

• parseability
• flags
• path handling
• cwd sensitivity
• git-specific escape conditions

If validation fails or is ambiguous, escalate to stricter permission handling.

Concurrency Rule

Read-only work may be run concurrently. Mixed or write-capable work must not inherit that privilege just because part of it looks harmless.

Anti-Patterns

• assuming git is always read-only
• treating a shell parse failure as probably safe
• allowing redirection because the main command is read-only
• classifying a compound command by its first segment only

Done Condition

You have applied this skill correctly when only truly read-only commands get the fast path, and ambiguous or risky command shapes are forced into the stricter permission path.