Menü
Safe wrappers for common Unix utilities
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Basierend auf der SOC-Berufsklassifikation
Safe wrappers for common Unix utilities
Allow nerf tools without prompting (supports glob patterns like nerf-git-*)
Allow/deny nerf tools by threat profile (read/write ceiling)
Deny nerf tools entirely (supports glob patterns like nerf-git-*)
List nerf tool permissions across all scopes
Reset nerf tools to ask-every-time (supports glob patterns like nerf-git-*)
| name | nerf-stdutils |
| description | Safe wrappers for common Unix utilities |
| targets | ["*"] |
These tools are available as scripts within this skill. Call them using the paths shown in each usage line.
These tools wrap standard Unix utilities with safety guardrails. Use find and find-cwd for file discovery without code execution capabilities. Use grep and grep-recursive-cwd for text search. Use print-range to extract a numeric line range from a file or stream. find-cwd, grep-recursive-cwd, and print-range-cwd are pre-scoped to the current directory.
General-purpose sed and awk are intentionally NOT wrapped --
their full surface area (in-place edits, shell-out via the e
command, arbitrary file writes via w) makes them dangerous to
permission broadly. Only the line-range filtering idiom is
covered, via print-range. If you have a sed/awk need that
print-range and grep don't cover, file a nerf-report so a
tightly-scoped wrapper can be added.
Note: the bash-hint redirect catches the most common forms
(sed -n 'N,Mp', sed --quiet 'N,Mp', awk 'NR>=N && NR<=M',
awk 'NR>N'). Less common variants like sed -nq '1,5p' or
sed -n -e '1,5p' may not trigger the redirect; nothing wrong
with using them, but consider print-range / print-range-cwd
first.
Search for files and directories. Exec-like actions are denied -- use this for discovery only, not for running commands on results.
Usage: scripts/nerf-find [tokens...]
Maps to: find "$@"
Denied patterns: -exec, -execdir, -ok, -okdir, -delete
Search for files and directories under the current directory. Exec-like actions are denied. The search root is always '.' (current directory).
Usage: scripts/nerf-find-cwd [tokens...]
Maps to: find . "$@"
Denied patterns: -exec, -execdir, -ok, -okdir, -delete
Search for a pattern recursively in the current directory. Prints matching lines with filenames and line numbers.
Usage: scripts/nerf-grep-recursive-cwd [--ignore-case|-i] [--line-regexp|-x] [--word-regexp|-w] [--count|-c] [--files-with-matches|-l] [--include <include>] [--exclude <exclude>] <pattern>
Maps to: grep -r -n <ignore_case> <line_regexp> <word_regexp> <count> <files_with_matches> <include> <exclude> -- <pattern> .
Switches:
--ignore-case, -i: Case-insensitive matching--line-regexp, -x: Match whole lines only--word-regexp, -w: Match whole words only--count, -c: Print only a count of matching lines per file--files-with-matches, -l: Print only filenames containing matchesOptions:
--include (optional): Search only files matching this glob (e.g. '*.py')--exclude (optional): Skip files matching this glob (e.g. '*.log')Arguments:
<pattern> (required): Regular expression pattern to search forSearch for a pattern in files or directories. Supports recursive search via -r. Files and directories are specified as trailing positional arguments after the pattern.
Usage: scripts/nerf-grep [--recursive|-r] [--ignore-case|-i] [--line-regexp|-x] [--word-regexp|-w] [--count|-c] [--files-with-matches|-l] [--include <include>] [--exclude <exclude>] <pattern> <paths...>
Maps to: grep -n <recursive> <ignore_case> <line_regexp> <word_regexp> <count> <files_with_matches> <include> <exclude> -- <pattern> <paths>
Switches:
--recursive, -r: Search directories recursively--ignore-case, -i: Case-insensitive matching--line-regexp, -x: Match whole lines only--word-regexp, -w: Match whole words only--count, -c: Print only a count of matching lines per file--files-with-matches, -l: Print only filenames containing matchesOptions:
--include (optional): Search only files matching this glob (e.g. '*.py')--exclude (optional): Skip files matching this glob (e.g. '*.log')Arguments:
<pattern> (required): Regular expression pattern to search for<paths...> (required): Files or directories to searchPrint a line range from a file or stdin. and are 1-indexed inclusive line numbers; both are required. With no , reads from stdin (so this works at the end of a pipeline). For workspace-scoped reads, use print-range-cwd instead. For "lines matching X" rather than a line range, use grep.
Usage: scripts/nerf-print-range <start> <end> [<file>]
Maps to: sed -n <start>,<end>p; <end>q <file>
Arguments:
<start> (required): First line number (1-indexed, inclusive). must match ^[1-9][0-9]*$<end> (required): Last line number (1-indexed, inclusive). must match ^[1-9][0-9]*$<file> (optional): File to read (omit to read from stdin)Print a line range from a workspace file. Like print-range, but is required and must resolve under the current directory (workspace-scoped read). Use this when you specifically want to read a file in the repo; use print-range for machine-scope reads or for filtering a piped stream.
Usage: scripts/nerf-print-range-cwd <start> <end> <file>
Maps to: sed -n <start>,<end>p; <end>q <file>
Arguments:
<start> (required): First line number (1-indexed, inclusive). must match ^[1-9][0-9]*$<end> (required): Last line number (1-indexed, inclusive). must match ^[1-9][0-9]*$<file> (required): File to read (must be under the current directory)Hit a bug, complaint, bypass-worthy guardrail, or want a feature? Use the nerf-report skill.