Bash Tool — Static Analyzer for Shell Scripts

Example: what the tool audits

curl -sSL https://example.com/install.sh | bash    # tool flags: unvetted remote exec
chmod 777 /var/log/app.log                          # tool flags: overly permissive
eval "$USER_INPUT"                                  # tool flags: eval on tainted input

What the bash tool covers

Security (command injection, unsafe eval, curl-pipe-bash), error handling (missing set -euo pipefail, ignored exit codes), quality (deprecated syntax, dead code), performance (useless-cat, unnecessary subshells), portability (bashisms in sh scripts), and 7 more dimensions.

Why a browser tool beats a CLI install

ShellCheck and shfmt require a Haskell or Go toolchain. This bash tool runs anywhere with a browser — locked-down laptops, corporate VMs, mobile phones during on-call. Zero install friction, same underlying analysis quality.

Output you can act on

Every finding names the line, the severity, the risk if left, and a concrete suggested fix. Export as PDF for stakeholders, Markdown for PRs, or JSON for CI pipelines.

Frequently asked questions

Is this bash tool open source?

The frontend and static-analysis logic are open. See the badge and GitHub link in the footer.

Does it handle heredocs correctly?

Yes — heredocs, here-strings, and process substitution are parsed and analyzed like the rest of the script.

What's the max script size?

1 MB or 25,000 lines. Above that, split the script — most real-world Bash beyond that size is a candidate for a real language anyway.