Shell tool — provides bash command execution in a hermetic child environment.

Registered through skills: like any other kit:

SkillKit.start_agent(
  skills: [
    {SkillKit.Tools.Shell, cwd: File.cwd!(), env: %{"LANG" => "en_US.UTF-8"}},
    {SkillKit.Kit.Local, dir: ".skills"}
  ]
)

Options

• :cwd — working directory for commands (default: File.cwd!())
• :env — map of non-secret ambient env vars to inject into the child process (%{"LANG" => "en_US.UTF-8"}). NOT a secret channel — use SkillKit.CredentialProvider for secrets.

Hermetic execution

Commands run under /usr/bin/env -i, which starts the child with an empty environment. SkillKit then sets exactly what the child should see, in this order:

1. Hardcoded base: PATH=/usr/bin:/bin and HOME copied from BEAM.
2. The tool-config :env map (non-secret ambient vars).
3. Credentials returned by the configured SkillKit.CredentialProvider. Credentials win on key collision.

BEAM's own environment (including ANTHROPIC_API_KEY and anything else the host app has set) does not leak into the child.