Przejdลบ do treล›ci

๐Ÿ›ก๏ธ AI Shell: Safe Usage Patterns

Using AI to write shell scripts introduces a new vector of risk. A single hallucinated flag or misunderstood context can result in destructive commands (like rm -rf / variations). Implementing Safe Usage Patterns ensures that AI-generated code is verified, linted, and sandboxed before execution.

๐ŸŽฏ The "Zero-Trust" Execution Rule

Never pipe AI output directly into a shell.

1
2
3
4
5
6
7
8
9
# โŒ LETHAL ANTI-PATTERN (AI piping)
ai "update all packages and clean up system" | sudo bash

# โœ… SAFE PATTERN
ai "update all packages and clean up system" > update.sh
cat update.sh      # 1. Human Review
shellcheck update.sh # 2. Automated Linting
bash -n update.sh  # 3. Syntax Dry-Run
./update.sh        # 4. Execution

๐Ÿงช Sandboxed Execution (The Ephemeral Container Pattern)

When an AI generates a complex script, test it in an ephemeral Docker container before running it on your host or in production.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
#!/bin/bash
# ai-sandbox-test.sh - Safely test AI generated scripts

TEST_SCRIPT="$1"

if [ ! -f "$TEST_SCRIPT" ]; then
    echo "Error: File not found" >&2
    exit 1
fi

echo "๐Ÿ” Linting with ShellCheck..."
if ! docker run --rm -v "$PWD:/mnt" koalaman/shellcheck:stable "$TEST_SCRIPT"; then
    echo "โŒ ShellCheck failed. Do not run this script." >&2
    exit 1
fi

echo "๐Ÿณ Running in ephemeral Ubuntu sandbox..."
docker run --rm \
    --network none \
    --read-only \
    --tmpfs /tmp \
    --tmpfs /run \
    -v "$PWD/$TEST_SCRIPT:/test.sh:ro" \
    ubuntu:24.04 bash /test.sh

echo "โœ… Sandbox execution finished."

Note: The container uses --network none (no internet) and --read-only (cannot modify container filesystem) to limit the blast radius if the AI generated malicious or destructive code.

๐Ÿค– Automated Linting Integration

Integrate standard linting tools directly into your AI workflow. If you build an AI CLI wrapper, make shellcheck a mandatory step.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
# ~/.bashrc or ~/.zshrc function
ask_ai_sh() {
    local prompt="$*"
    local tmpfile
    tmpfile=$(mktemp /tmp/ai_script_XXXXXX.sh)

    echo "Generating script..."
    # Assuming 'llm' is a generic CLI tool for your LLM of choice
    llm "Write a strict bash script to: $prompt. Output ONLY the code." > "$tmpfile"

    echo "--- GENERATED CODE ---"
    cat "$tmpfile"
    echo "----------------------"

    if command -v shellcheck >/dev/null; then
        echo "๐Ÿ” Running ShellCheck..."
        if shellcheck "$tmpfile"; then
            echo "โœ… ShellCheck Passed."
        else
            echo "โŒ ShellCheck found issues. Review carefully."
        fi
    fi

    echo "Script saved to $tmpfile"
}

๐Ÿ›ก๏ธ Dropping Privileges for AI Scripts

If an AI-generated script must be run as a service or cron job, enforce the Principle of Least Privilege using a dedicated, restricted user.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
# 1. Create a restricted user with no shell login
sudo useradd -r -s /usr/sbin/nologin ai_worker

# 2. Run the AI script as this user
sudo -u ai_worker bash ai_generated_script.sh

# 3. (Advanced Linux) Use systemd-run for dynamic cgroups and capability dropping
systemd-run --user --scope \
    -p "ProtectSystem=strict" \
    -p "ProtectHome=read-only" \
    -p "PrivateNetwork=yes" \
    bash ai_generated_script.sh

๐Ÿ”„ Human-in-the-Loop (Approval Flows)

If you are using AI to generate scripts within an automated CI/CD pipeline (e.g., using an LLM to generate migration scripts dynamically), you must implement an approval flow.

  1. AI Generates Script -> Saves to generated/migration_123.sh
  2. CI Pipeline -> Runs shellcheck and creates a Pull Request.
  3. Human Reviewer -> Reviews the PR. Checks for:
  4. Destructive commands (rm, drop, truncate).
  5. Hardcoded credentials.
  6. Idempotency.
  7. Merge & Execute -> Runs only after human approval.

๐Ÿงพ Summary Checklist

โœ… Never Pipe to Shell: Never do ai | bash. โœ… ShellCheck Everything: Make shellcheck a mandatory step for AI output. โœ… Use Sandboxes: Test complex AI scripts in --network none Docker containers. โœ… Restrict Privileges: Run AI scripts as non-root, restricted users. โœ… Human in the Loop: Require human review for scripts affecting production state.

๐Ÿงพ See Also