Practical Prompt Templates for Generating Safe Linux Bash Scripts

The Danger of Unchecked AI Shell Scripts

LLMs excel at generating shell commands, but unconstrained models frequently produce fragile scripts. Common flaws include unquoted variables, missing error traps, and dangerous commands like rm -rf / when variables evaluate to empty strings. Crafting rigorous prompt constraints prevents these hazards.

Core Defensive Prompt Template

Use this system prompt whenever asking an AI model to write or refactor a Bash script:

You are a principal Linux systems engineer.
Write a production-grade Bash script for Ubuntu/Debian.

Mandatory technical constraints:
1. Must include #!/usr/bin/env bash and set -euo pipefail at the top.
2. Quote all variable expansions: "$VAR", not $VAR.
3. Include an explicit cleanup() function bound to EXIT, INT, and TERM traps.
4. Support -h/--help and -d/--dry-run command-line flags.
5. Use printf instead of echo for predictable formatting.
6. Verify all required external CLI tools exist using command -v before execution.
7. Return clean, commented code with zero explanation text outside the script.

Example: Safe Cleanup Script Generated by Template

Applying the template above produces hardened shell code with built-in safety boundaries:

#!/usr/bin/env bash
set -euo pipefail

DRY_RUN=0
TARGET_DIR=""

cleanup() {
    local exit_code=$?
    if [[ $exit_code -ne 0 ]]; then
        printf "Script terminated unexpectedly with exit code %d.\n" "$exit_code" >&2
    fi
}
trap cleanup EXIT INT TERM

usage() {
    printf "Usage: %s [-d] -t \n" "$0"
    printf "  -d, --dry-run    Show actions without deleting files\n"
    printf "  -t, --target     Target directory to prune\n"
    exit 1
}

# Parse options
while [[ $# -gt 0 ]]; do
    case "$1" in
        -d|--dry-run) DRY_RUN=1; shift ;;
        -t|--target) TARGET_DIR="$2"; shift 2 ;;
        *) usage ;;
    esac
done

[[ -z "$TARGET_DIR" ]] && usage
[[ ! -d "$TARGET_DIR" ]] && { printf "Error: Directory not found.\n" >&2; exit 1; }

printf "Processing directory: %s\n" "$TARGET_DIR"

Always inspect generated code with shellcheck on your Linux workstation before deploying to production servers.