sh Script Checker — Validate POSIX Shell Scripts
A dedicated sh script checker for validating any `#!/bin/sh` script. Portability-first, security-aware, and available with zero install.
Validation scope
# Every sh script gets:
# - Parse validation (would `dash -n` succeed?)
# - Portability audit (no bashisms)
# - Safety audit (no unsafe eval, unquoted expansion, curl-pipe-sh)
# - Quality checks (error handling, exit codes, temp file safety)
What "validated" means here
Parseable under POSIX shells, free of common bashisms, quoting-safe, and free of the most common security anti-patterns. Any of those failing produces a line-anchored finding.
When to validate
Before shipping a shell installer, before deploying to a container that uses BusyBox, or as a portability gate in your review process.
Compared to `dash -n`
`dash -n` only checks parse-ability. The sh script checker adds portability, safety, and quality dimensions on top.
Frequently asked questions
- Does the sh script checker require sh installed?
- No. It runs entirely in the browser session — no shell on your machine required.
- Does it validate against dash specifically?
- It validates against the POSIX shell standard. dash is the most common enforcement point, so findings usually match dash's behavior.
- Is my script logged?
- No. Not stored server-side, not logged, not used for training.