AI Agent Engineer

AI Agent Engineer

15 Shell Environment and Variables

3 min read

15 Shell Environment and Variables

Learning objectives

  • Inspect and set environment variables.
  • Create command aliases.
  • Reload Shell configuration files.

Command overview

CommandPurposeMeaningBasic usageExample
envInspect or construct a child-process environmentDoes not include all Shell variables and can contain secretsenvenv -i PATH=/usr/bin /usr/bin/env
exportMark an environment variableMakes it inheritable by later child commands; does not affect parent or existing processesexport name=valueexport APP_ENV=dev
aliasSet a command aliasGives a common command a shorter namealias name='command'alias ll='ls -lah'
sourceReload a scriptExecutes script contents in the current Shellsource filesource ~/.bashrc
typeInspect a command typeDetermines whether a command is a builtin, alias, function, or executable filetype commandtype cd
bashEnter a Bash ShellStarts the Bash command interpreterbashbash
zshEnter a zsh ShellStarts the zsh command interpreterzshzsh

Common scenarios

Inspect only variables that may be disclosed:

printf 'home=%s\n' "$HOME"
printf 'app_env=%s\n' "${APP_ENV:-unset}"

Set a temporary variable:

export APP_ENV=dev
printf '%s\n' "$APP_ENV"

Add a directory to PATH:

export PATH="$PATH:$HOME/bin"

Set aliases:

alias ll='ls -lah'
alias gs='git status'

Loading configuration executes code in the current Shell, so these are syntax reference for trusted files only:

. "$HOME/.bashrc"
source "$HOME/.bashrc"

Inspect a command source:

type cd
type ll
type python3

Notes for beginners

  • A variable set directly with export generally lasts only for the current terminal session.
  • A Shell variable enters later child processes only after export; env does not list every unexported Shell variable.
  • Bash login/non-login and interactive/non-interactive modes read different startup files. zsh rules differ too, so do not always write to ~/.bashrc.
  • source is Bash syntax; . is the POSIX form. Both execute arbitrary code in the current Shell, so load only trusted, reviewed files.
  • An alias normally needs a Shell configuration file to persist.
  • type cd shows that cd is a Shell builtin, which is why which cd can be counterintuitive.

Single quotes, double quotes, and secrets

value='one two'
printf '<%s>\n' "$value"
printf '%s\n' 'literal $value'
printf '%s\n' "expanded $value"

Variable expansions should normally be in double quotes. Even in environment variables, secrets can appear in process environments, debug logs, crash dumps, or child processes. Do not use bare env, set, or export -p to gather troubleshooting evidence.

PATH safety

  • PATH is searched left to right. An empty component or untrusted writable directory can enable command hijacking.
  • Before adding a directory, inspect its canonical path, owner, and permissions; do not put . at the front of PATH.
  • A script can record a critical tool’s source with command -v first. High-security situations use controlled absolute paths and a minimal environment.
command -v -- python3
printf '%s\n' "$PATH" | tr ':' '\n' | nl -ba

Remove private paths and internal mount information before publishing a report.

Exercise

Create an ordinary Shell variable LOCAL_ONLY and an exported CHILD_VISIBLE, then compare them in a child Bash:

LOCAL_ONLY='local'
export CHILD_VISIBLE='child'
bash -c 'printf "local=%s child=%s\n" "${LOCAL_ONLY:-unset}" "${CHILD_VISIBLE:-unset}"'

The expected result is that the child process cannot see the unexported variable. The exercise uses no real token and modifies no startup file.

References

Backlinks