Shell Script Checker — Static Analysis for Sh & Bash

Example: what the shell script checker flags

#!/bin/sh
# Fragile install script — the checker flags 4 issues here
VERSION=$1
curl -s http://example.com/pkg-$VERSION.tar.gz | tar xz
cd pkg-$VERSION && make install
rm -rf /tmp/build-*

What the shell script checker reviews

Every script is graded across 12 dimensions: executive risk score, security vulnerabilities, error handling, code quality, best practices, performance, portability between bash and sh, dependency assumptions, input validation, resource management, recommendations, and positive observations. Each finding cites a line number, a severity (info → high), a plain-English description, and a suggested fix — you jump to the issue, not hunt for it.

Common shell issues this catches

Unquoted command substitutions like $(cmd) that word-split on whitespace, missing set -euo pipefail, command injection via unvalidated $1 arguments, curl | bash patterns without checksum verification, race conditions in /tmp file handling, missing error checks on rm/mv/cp, hard-coded root paths, and Bash-only constructs used inside a #!/bin/sh script.

Shell script checker vs local ShellCheck

Local ShellCheck is a Haskell binary you install via brew, apt, or cabal — great for pre-commit hooks and CI. This online shell script checker runs the same class of ShellCheck-style rules plus deeper security and portability checks, with zero install. Use this when you're reviewing a script from a chat, a gist, a Stack Overflow answer, or a curl-install page — anywhere you don't have a shell open.

Shell script checker vs `bash -n`

`bash -n script.sh` only checks that bash can parse the file. It will not catch unquoted variables, undefined references, unsafe patterns, portability issues, or logic bugs — a syntactically valid script can still `rm -rf /`. This checker is a superset: it parses the script *and* reasons about intent, so you catch the whole class of ShellCheck warnings plus security issues that `bash -n` never sees.

Built for review, not refactor

The tool is intentionally read-only. It surfaces issues with explanations so you can decide what to fix — it will not silently rewrite your script. If you want a fixed version, there is a separate one-click "generate fix" action on the results screen that produces a diff you can review before applying.

When to use this vs the homepage

The homepage tool at bashchecker.com is the same analyzer with a generic landing. This /shell-script-checker page is aimed at sh scripts and POSIX-portable code specifically — the guidance below and FAQ answers focus on the sh vs bash split. If you're auditing a mixed sh/bash codebase, start here.

Frequently asked questions

Which shells are supported?

Bash, sh (POSIX), and most ksh/dash variants. Portability findings flag Bash-only features (arrays, [[ ]], process substitution) when they appear inside a #!/bin/sh script.

Is there a script size limit?

Yes — 1MB or 25,000 lines maximum per analysis. Larger scripts should be split or reviewed section by section.

Can I export the report?

Yes — download as PDF, Markdown, or JSON after analysis completes. The Markdown export is convenient for pasting into a PR review or an incident postmortem.

Can I check a bash script without installing anything?

Yes — that is the whole point. Open this page, paste the script, click Analyze. Nothing is installed on your machine and nothing is executed on ours.

Does this replace ShellCheck?

For interactive review, yes. For pre-commit hooks and CI you should still run local ShellCheck for speed. This online checker covers the same rule families plus security and portability checks ShellCheck does not perform.

What does `bash -n` miss that this catches?

Everything beyond parse errors: unquoted expansions, undefined variables, unsafe commands, dependency assumptions, and portability regressions. `bash -n` is a syntax gate, not a review.