Bash Script Analyzer — 12-Dimension Static Review
A free Bash script analyzer that delivers a structured, 12-dimension static review of any shell script in about 90 seconds. Designed for security engineers, SREs, and developers who run untrusted or legacy bash code — every finding includes a line number, a severity, and a suggested fix, and your script is never executed on our servers.
Example: how the analyzer scores a script
#!/bin/bash
# This script gets a risk score of ~68 (high) from the analyzer
BACKUP_DIR=/var/backups
rm -rf $BACKUP_DIR/*
tar czf $BACKUP_DIR/db-`date +%F`.tgz /var/lib/mysql
curl -X POST https://webhook.site/xyz -d "backup done"The 12 analysis dimensions
Executive summary with a 0–100 risk score, security vulnerabilities, error handling, code quality, best practices, performance issues, portability analysis, dependency audit, input validation audit, resource management, recommendations, and positive observations. Each section is independently collapsible and independently exportable, so you can share just the security findings with a security team and just the portability findings with a platform team.
How the risk score works
Each script receives a 0–100 risk score. 0–30 is low risk, 31–60 medium, 61–80 high, 81–100 critical. The score weighs severity and count of findings across all 12 dimensions — a single high-severity `rm -rf $UNSET_VAR` is scored higher than ten info-level style nits. Treat the score as a triage signal for prioritizing review queues, not a pass/fail gate.
Real use cases
Reviewing install.sh scripts before piping curl to bash, auditing CI/CD pipeline scripts inherited from a previous team, inspecting cron jobs on a server you just took over, vetting community scripts from GitHub gists, and teaching safe shell scripting practices to junior engineers by showing them what a real analyzer flags.
Bash script analyzer vs plain code review
A human reviewer will catch the intent-level issues an analyzer misses, but will also miss the mechanical issues an analyzer catches at 100% recall — every unquoted variable, every missing error check, every SC2xxx pattern. Use both: run the analyzer first to clear the mechanical debt, then do the human review focused on logic and architecture.
What the analyzer will not do
It will not execute your script, apply fixes automatically, guess at intent when the script is ambiguous, or invent findings when the script is clean. If a section returns empty, that section had nothing to report — not that the analyzer got tired.
Analyzer output you can export
Every analysis is exportable as PDF (for archival and audit trails), Markdown (for pasting into PR reviews and Slack), and raw JSON (for machine consumption in your own dashboards). The JSON schema is stable and versioned.
Frequently asked questions
- How accurate is the risk score?
- The score is a static-analysis estimate — it weighs severity and count of findings but cannot know runtime context. A script that looks dangerous statically may be perfectly safe if invoked correctly. Treat the score as a triage signal, not a verdict.
- Can I analyze the same script repeatedly?
- Yes. Repeat analyses of identical scripts return instantly from a client-side cache (SHA-256 keyed, 1-hour TTL, 10 entries).
- Are findings auto-fixed?
- No — the analyzer is read-only. There is a separate "generate fix" action on the results screen that produces a diff you can review before applying anything.
- Does this replace ShellCheck?
- It covers ShellCheck-style rules plus 8 additional dimensions ShellCheck does not check (security, dependencies, resource management, input validation, etc.). For pre-commit and CI, keep local ShellCheck. For deep review, use this.
- Can I analyze scripts written in POSIX sh, not bash?
- Yes. Portability findings will flag Bash-only features that would break under a real /bin/sh interpreter.
- How long does analysis take?
- About 90–120 seconds regardless of script size — the bottleneck is model output tokens, not input parsing.