ShellCheck vs Bash Checker
ShellCheck vs Bash Checker: a fast local linter versus an online review with security analysis. Side-by-side comparison and when to use each.
Tldr
ShellCheck is a rule-based linter that runs locally in milliseconds and catches well-defined quoting, syntax, and portability bugs. Bash Checker is an AI-powered review that runs in 1–2 minutes and adds security analysis, intent review, and prose recommendations ShellCheck cannot produce. Use ShellCheck in CI for every commit; use Bash Checker on review for any script you didn't write.
Sections
Heading
What each tool actually does
Body
ShellCheck implements ~300 hand-written rules (the SCxxxx codes) that pattern-match the AST of your script. Every finding is deterministic, instant, and traceable to a rule. Bash Checker sends the script to a large language model with a structured prompt that produces a 12-section report covering security vulnerabilities, error handling, code quality, portability, dependency audit, and prose recommendations. The model can reason about intent — "this curl pipes to bash from an unauthenticated URL" — which a pattern matcher cannot.
Heading
Speed and CI fit
Body
ShellCheck runs in under 100ms per script and integrates cleanly with pre-commit hooks, GitHub Actions, and GitLab CI. Bash Checker takes 90–120 seconds because the bottleneck is LLM output generation. It is built for interactive review, not per-commit linting.
Heading
What ShellCheck misses
Body
ShellCheck does not flag destructive commands as risky (rm -rf, dd, mkfs are valid shell — they pass), does not detect curl | bash patterns, does not check for hardcoded secrets, and does not reason about whether input validation is appropriate for the context. Bash Checker covers all of these in its security section.
Heading
What Bash Checker misses
Body
Bash Checker does not currently ship a CLI, does not produce stable rule IDs you can suppress with comments, and is non-deterministic — two runs of the same script may surface findings in different order. For a code review queue or a security audit those tradeoffs are fine; for a 50ms pre-commit check they are not.
Heading
They complement each other
Body
ShellCheck in CI and pre-commit catches the deterministic stuff before it ships. Bash Checker on demand handles the harder questions: "is this third-party install.sh safe to run?", "what is this 800-line legacy script actually doing?", "what would I miss reviewing this PR myself?".
Verdict
Use both. ShellCheck for fast, deterministic linting in CI; Bash Checker for security review, intent analysis, and reviewing scripts you did not write.
Faq
Q
Is Bash Checker a replacement for ShellCheck?
A
No. Bash Checker runs ShellCheck-style checks plus deeper security analysis, but ShellCheck is faster and deterministic — keep it in CI.
Q
Does Bash Checker use ShellCheck under the hood?
A
No. Bash Checker uses an LLM with a structured prompt. The findings overlap with ShellCheck for common cases but the engine and rule set are different.
Q
Can I run Bash Checker in CI?
A
Not today. It is hosted and interactive — open the site, paste the script, get the report. ShellCheck is the right CI tool.