# Shell Confirm Hygiene

> Decide when to pause for user confirmation before running a shell command, and how to keep flow afterward. Use before running commands that are destructive, irreversible, cross trust boundaries, contain shell expansion/subexpressions, touch the network, or modify state outside the working tree.

- Skill: `jcdavis131/shell-confirm-hygiene` (Agent Skill)
- Install (CLI): `npx skillmds@latest add jcdavis131/shell-confirm-hygiene`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jcdavis131/shell-confirm-hygiene/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: jcdavis131 (https://skillmd.com/u/jcdavis131)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/jcdavis131/shell-confirm-hygiene

---


# Shell Confirm Hygiene

The default is to run commands directly. Pausing is the exception, not the rule — but when in doubt, pause once.

## Pause for confirmation when any of these hold

- **Destructive / irreversible:** `rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, deleting branches, mass file deletes, `docker system prune -a`.
- **Modifies state outside the working tree:** installs/uninstalls, system config, env vars on a host, `git config` (global), changing shared resources.
- **Network egress with side effects:** deploys, publishes (`npm publish`), webhook calls, anything hitting a production API.
- **Shell expansion / subexpressions:** commands containing `$()`, backticks, `Invoke-Expression`, or dynamic argument construction where input could expand unexpectedly. The risk is hidden injection, not the command itself.
- **Crosses a trust boundary:** runs downloaded code, executes a file the user did not author, shells out to a remote script.
- **First occurrence of a command shape you'll repeat many times** — confirm once so the user can allowlist the shape; subsequent identical runs stay silent.
- **`cd` combined with a path-bearing operation.** A leading `cd` can relocate the effective working directory before a subsequent path resolves, so the path the user reads and the path actually used can diverge. This is a distinct risk class from raw subexpression injection — treat compound `cd <dir>; <uses-a-path>` as its own confirm trigger.

## Do NOT pause for

- Read-only inspection: `ls`, `cat`, `git status`, `git log`, `git diff`, `Get-PSDrive`, `Measure-Object`, `df`, `find`, `rg`.
- Builds, tests, linters, formatters — these are reversible and expected.
- Edits inside the working tree you were already asked to make.
- Commands the user explicitly typed or approved in their message.

## How to pause

State in one line: what the command does and the one concrete risk. Offer: proceed / proceed and don't ask again for this shape / cancel. Don't lecture; the user already knows the command.

## After a "don't ask again" approval

Record the allowed shape mentally by its command head + intent (e.g. "Get-PSDrive C with Measure-Object count"). Re-prompt only if a later call adds a materially riskier operation (network, delete) on top.

## Principle

Every pause costs flow. Every skipped pause on a risky command costs trust. Bias toward pausing on the first risky occurrence of a shape, then let the allowlist carry the repetition.