# Read Only Shell Guard

> Use when deciding whether shell commands are truly read-only, safe for concurrent execution, and free of path, git, redirection, or command-shape risks that should force a stricter permission path

- Skill: `chuanzige/read-only-shell-guard` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add chuanzige/read-only-shell-guard`
- Raw SKILL.md: https://api.skillmd.com/api/skills/chuanzige/read-only-shell-guard/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: chuanzige (https://skillmd.com/u/chuanzige)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/chuanzige/read-only-shell-guard

---


# Read Only Shell Guard

## Overview

Not every harmless-looking command is actually read-only. This skill follows the guardrails in `src/tools/BashTool/readOnlyValidation.ts` and related shell validation utilities.

## Read-Only Means

A read-only command may inspect state, but it must not:

- modify files
- create files
- redirect output into files
- invoke write-capable git flows
- change system state

## Safe Categories

Usually safe when validated:

- `rg`, `grep`, `find`, `cat`, `head`, `tail`, `wc`, `stat`
- read-only `git` queries
- read-only `gh` queries
- filtered inspection commands with safe flags

## Automatic Red Flags

Treat the command as non-read-only when you see:

- output redirection
- file creation or mutation
- mixed `cd` and `git` compound commands in sandboxed contexts
- git operations outside the original cwd when sandbox rules depend on cwd
- writes into git-internal paths
- UNC path or traversal risk
- shell parse failure

## Compound Command Rule

The whole command is only read-only if every subcommand is read-only.

One unsafe segment makes the batch unsafe.

## Validation Rule

Do not trust the command's story. Validate:

- parseability
- flags
- path handling
- cwd sensitivity
- git-specific escape conditions

If validation fails or is ambiguous, escalate to stricter permission handling.

## Concurrency Rule

Read-only work may be run concurrently. Mixed or write-capable work must not inherit that privilege just because part of it looks harmless.

## Anti-Patterns

- assuming `git` is always read-only
- treating a shell parse failure as probably safe
- allowing redirection because the main command is read-only
- classifying a compound command by its first segment only

## Done Condition

You have applied this skill correctly when only truly read-only commands get the fast path, and ambiguous or risky command shapes are forced into the stricter permission path.