Merge in a checklist-style "provisioning script safety" section, adapted
from wshobson/agents' bash-defensive-patterns skill (fetched directly
from GitHub, MIT licensed) rather than trusted from its catalog summary.
Covers: shell-choice caution (#!/bin/bash isn't guaranteed on FreeBSD;
bash is a package at /usr/local/bin/bash, not base), a contextual
error-handling philosophy instead of a blanket `set -Eeuo pipefail`,
trap-based cleanup/logging for scripts interrupted mid-jail-creation
(without auto-rollback, which can worsen the known destroy/create IP
churn issue), jail-name/IP input validation before destructive `bastille`
commands, and FreeBSD `mktemp`/`sed -i`/`date` syntax differences from
GNU. Deliberately dropped the upstream's interactive `rm -rI` cleanup
pattern (wrong for unattended SSH automation) and did not import
retry/locking/ShellCheck-gate advice that wasn't actually present in the
real upstream files. Cross-references remote-shell-quoting-safety instead
of duplicating its nested-shell-quoting content.
Also documents the /usr/local/bastille vs /www/bastille bastille_prefix
split already present across this fleet's hosts (gringo/staging vs
granja), which the new script-safety guidance assumes readers already
know not to hardcode.
Full worked patterns and code examples live in the new
references/script-safety.md; SKILL.md keeps the load-bearing summary.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
MalinandClaude Sonnet 5
251498ad58