agentleFS
YehudaFrankelYehudaFrankel/clankbrain/.claude/skills/powershell-safe/SKILL.md

powershell-safe

Skill16 starsChanged 7 months agoMITView on GitHub

Enforce safe PowerShell string patterns before writing or editing any .ps1 file, or before passing PowerShell via the Bash tool. Triggers on "write a powershell script", "edit the .ps1", "run powershell", "powershell command", or any task that produces PowerShell content.

1 other project uses a version of this.

Adopted by

Most recently taken up by

The file

We split this skill into the rules it gives an agent

8 rules. About 0 are common, 3 are distinctive, and 5 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈3

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 5

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Never: use em dashes (—) — replace with hyphen-minus (-) or --

    line 16
  2. Very specific:

    Never: use curly/smart quotes (" " ' ') — use straight quotes only

    line 17
  3. Very specific:

    Never: use emoji in string literals or comments inside .ps1 files

    line 18
  4. Very specific:

    When passing PowerShell through the Bash tool, $variables get expanded by the shell before PowerShell sees them:

    line 24
  5. Very specific:

    Write to a .ps1 file first, then execute: powershell -File script.ps1

    line 27
  6. Distinctive:

    Use single quotes for the outer Bash string when the PowerShell content contains backticks

    line 42
  7. Distinctive:

    Prefer writing the script to a file and executing it instead

    line 48
  8. Distinctive:

    Verify it prints cleanly before embedding in a larger command or script.

    line 55

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Skill: powershell-safe

Auto-applies whenever writing, editing, or running PowerShell content.


Rules — apply every time, no exceptions

1. ASCII-only strings

  • Never use em dashes (—) — replace with hyphen-minus (-) or --
  • Never use curly/smart quotes (" " ' ') — use straight quotes only
  • Never use emoji in string literals or comments inside .ps1 files
  • Never copy-paste text from markdown/chat that may contain Unicode punctuation

Em dashes silently corrupt .ps1 files — PowerShell parses them as unknown tokens, failing with no clear error message.

2. Variable interpolation via Bash tool

When passing PowerShell through the Bash tool, $variables get expanded by the shell before PowerShell sees them:

  • Wrap the entire command in single quotes to prevent shell expansion, OR
  • Escape every $ as `$ inside double-quoted Bash strings, OR
  • Write to a .ps1 file first, then execute: powershell -File script.ps1
# WRONG — $name expanded by shell, PowerShell sees empty string
powershell -Command "Write-Output $name"

# RIGHT — single quotes prevent shell expansion
powershell -Command 'Write-Output $name'

# RIGHT — write file, execute file
echo 'Write-Output $name' > tmp.ps1 && powershell -File tmp.ps1

3. Backticks in strings

PowerShell uses backtick (`) as its escape character. Inside Bash double-quoted strings, backticks trigger command substitution:

  • Use single quotes for the outer Bash string when the PowerShell content contains backticks
  • Or escape as \` in double-quoted contexts

4. Here-strings via Bash

PowerShell here-strings (@" "@ or @' '@) are fragile through Bash:

  • The closing "@ or '@ must be at the start of a line with no leading whitespace
  • Prefer writing the script to a file and executing it instead

5. Test before embedding

For any non-trivial PowerShell string, test with Write-Output first:

Write-Output "your string here"

Verify it prints cleanly before embedding in a larger command or script.


Checklist — run before writing any PowerShell

  • No em dashes, smart quotes, or emoji in string literals
  • $variables protected from shell expansion (single quotes or file-based execution)
  • Backticks handled correctly for context (Bash single-quoted or escaped)
  • Here-string closers at column 0 if used
  • Tested with Write-Output if any doubt about a string value

Common failures

SymptomRoot causeFix
Unexpected token with no obvious causeEm dash in stringReplace — with -
$variable always emptyShell expanded it before PowerShell ranSingle-quote the Bash string
Here-string parse errorClosing "@ has leading whitespaceMove to column 0
Backtick disappearsBash swallowed it as command substitutionSingle-quote the Bash wrapper

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.