Check shell script

Flag four specific shell-source hazards locally, then hand the script to a real shell parser and ShellCheck.

freeworks offlinenothing uploaded
ToolShell Script Checker
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

The text checks look for for-in around $(ls), selected unquoted variable arguments, [[ beneath a /bin/sh shebang, and eval followed by variable input. No tokens or syntax tree are built, so dialect, quoting context, and control flow are otherwise unknown.

  • An empty list means these four expressions did not match, not that a script is safe.
  • The /bin/sh test is the only interpreter-sensitive branch.

Worked example

Check shell script
Input
											#!/bin/sh
for f in $(ls *.txt); do echo $f; done
Output
												Issues: Do not parse ls output; iterate over the glob directly., Quote variable expansions unless word splitting is intentional.
Issue count: 2
Note: Focused heuristic check; run the real ShellCheck program for complete analysis.

When to use this

Commit checks catch ls loops, POSIX reviews spot Bash double brackets, and security passes surface eval applied to variable data.

Edge cases

  • Matching text inside a shell comment can still trigger a warning.
  • Unquoted expansion in commands outside the small listed set can be missed.
  • A Bash file without a /bin/sh shebang receives no interpreter validation.

References