# Command Execution Principles

> Apply safe command execution patterns when spawning external processes, shell commands, or system calls from application code. Covers input sanitization, timeout handling, output capture, and error propagation.

- Skill: `irahardianto/command-execution-principles-3` (Agent Skill)
- Install (CLI): `npx skillmds@latest add irahardianto/command-execution-principles-3`
- Raw SKILL.md: https://api.skillmd.com/api/skills/irahardianto/command-execution-principles-3/raw
- Safety review: pending (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: irahardianto (https://skillmd.com/u/irahardianto)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/irahardianto/command-execution-principles-3

---


## Command Execution Principles

### Security

**Never execute user input directly:**

- ❌ `exec(userInput)`  
- ❌ `shell("rm " + userFile)`  
- ✅ Use argument lists, not shell string concatenation  
- ✅ Validate and sanitize all arguments

**Run with minimum permissions:**

- Never run commands as root/admin without explicit human approval. If elevated permissions are absolutely required, STOP and request authorization.
- Use least-privilege service accounts

### Portability

**Use language standard library:**

- Avoid shell commands when standard library provides functionality  
- Example: Use file I/O APIs instead of `cat`, `cp`, `mv`

**Test on all target OS:**

- Windows, Linux, macOS have different commands and behaviors  
- Use path joining functions (don't concatenate with /)

### Error Handling

**Check exit codes:**

- Non-zero exit code = failure  
- Capture and log stderr  
- Set timeouts for long-running commands  
- Handle "command not found" gracefully

### Command Execution Checklist

- [ ] Is user input sanitized/validated before use in commands?
- [ ] Are arguments passed as lists (not shell string concatenation)?
- [ ] Are commands running with minimum necessary permissions?
- [ ] Are exit codes checked and errors handled?
- [ ] Are timeouts set for long-running commands?
- [ ] Is stderr captured and logged?

### Related Principles
- Security Mandate @.claude/rules/security-mandate.md
- Security Principles @.claude/rules/security-principles.md