Claude Code Bash Patterns

What it does

When your agent uses it

• PreToolUse hooks
• Command chaining
• CLI orchestration
• Custom commands

Example prompts

• “/claude-code-bash-patterns”

Requirements

• Python 3
• A Bash shell
• A credential in API_KEY

Workflow steps

5 steps, taken from the step headings in SKILL.md.

1. 1Sequential Operations (&&)
2. 2Parallel Operations (Multiple tool calls)
3. 3Session Persistence
4. 4Background Processes
5. 5Hooks for Automation

What it can do on your machine

Read from SKILL.md and the folder at commit 8837836. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 3 files in scripts/ (Shell and Python), which the agent can run.

  Shell commands in SKILL.md call:

  • git
  • npm
  • bun
  • bunx
  • curl
  • gh

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Links to these hosts (documentation or services it may open):

  • docs.claude.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • API_KEY

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Claude Code Bash Patterns loads about 2.1k tokens when it runs, and up to ~11k if it reads all its reference files. Until then it costs about 66 tokens; SKILL.md has 606 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~66

When it runs · the whole SKILL.md, loaded when a task matches

~2.1k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~11k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from secondsky/claude-skills at commit 8837836, republished under its MIT licence (© secondsky). 606 words, ~2,147 tokens.

name

claude-code-bash-patterns

description

Claude Code Bash tool patterns with hooks, automation, git workflows. Use for PreToolUse hooks, command chaining, CLI orchestration, custom commands, or encountering bash permissions, command failures, security guards, hook configurations.

license

MIT

metadata.version

2.0.0

metadata.last_verified

2025-11-18

metadata.production_tested

true

metadata.token_savings

55%

metadata.errors_prevented

12

metadata.templates_included

5

metadata.references_included

5

ls -la

bun install && bun run build && bun test

#!/usr/bin/env bash
# PreToolUse hook - runs before every Bash command

echo "Running: $1"

git add . && git commit -m "message" && git push

Message with multiple Bash tool calls in parallel

# Set environment variable
export API_KEY="sk-..."

# Use in later commands (same session)
curl -H "Authorization: Bearer $API_KEY" api.example.com

npm run dev &
# Get PID with $!

git add . && git commit -m "feat: add feature"

npm test && git add . && git commit -m "fix: bug fix" && git push

git checkout -b feature/new && git add . && git commit -m "feat: new feature" && git push -u origin feature/new

#!/usr/bin/env bash
COMMAND="$1"

# Log all commands
echo "[$(date)] Running: $COMMAND" >> ~/claude-commands.log

# Block dangerous patterns
if [[ "$COMMAND" =~ rm\ -rf\ / ]]; then
    echo "❌ Blocked dangerous command"
    exit 1
fi

bun install && bun run build

bunx wrangler deploy

gh pr create --title "Fix bug" --body "Description"

---
description: Deploy to production
---

Run these steps:
1. Run tests: `npm test`
2. Build: `npm run build`
3. Deploy: `wrangler deploy`

{
  "dangerousCommandsAllowList": [
    "git push --force"
  ]
}

# ✅ Good: Use environment variables
export API_KEY="$SECURE_VALUE"

# ❌ Bad: Hardcode secrets
curl -H "Authorization: Bearer sk-abc123..."

npm test && git add . && git commit -m "message"

npm run lint && npm test && npm run build && bunx wrangler deploy

cd repo1 && git pull && cd ../repo2 && git pull

npm run dev &

# Background mode
npm run dev &

cd "path with spaces/file.txt"

git checkout -b feature/oauth && \
  npm test && \
  git add . && \
  git commit -m "feat(auth): add OAuth support" && \
  git push -u origin feature/oauth

npm run lint && \
  npm test && \
  npm run build && \
  bunx wrangler deploy

cd project1 && bun install && cd ../project2 && bun install

© secondsky, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 13 other files (scripts, references) in plugins/claude-code-bash-patterns/skills/claude-code-bash-patterns of secondsky/claude-skills.

• SKILL.md
• references/cli-tool-integration.md
• references/git-workflows.md
• references/hooks-examples.md
• references/security-best-practices.md
• references/troubleshooting-guide.md
• scripts/bash-audit-logger.sh
• scripts/dangerous-command-guard.py
• scripts/package-manager-enforcer.sh
• templates/.envrc.example
• templates/custom-command-template.md
• templates/dangerous-commands.json
• templates/github-workflow.yml
• templates/settings.json

Open the folder on GitHubat commit 8837836