sota-shell-scripting — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sota-shell-scripting (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Purpose: produce shell scripts that survive contact with reality — unusual filenames, missing commands, partial failures, hostile input, signals, and concurrent invocation — and audit existing scripts for the defect classes that cause most production shell incidents: unquoted expansions, silent error swallowing, injection, secret leakage, and temp-file races.
Bash-focused (bash 5.x current; macOS ships bash 3.2 and defaults to zsh — see portability rules). POSIX sh only when the target demands it (busybox/dash containers, init systems).
Do NOT use shell when any of these hold. Recommend Python/Go (or the project's primary language) instead, and say so explicitly in BUILD and AUDIT output:
jq one-liner, sets).jq/yq.wait".Shell is the right tool for: gluing processes together, CI steps, container entrypoints, small install/deploy wrappers, environment setup — anything that is mostly invoking other programs rather than computing.
When writing or modifying shell scripts:
#!/usr/bin/env bash unless the target is a minimalcontainer/init context that only guarantees POSIX sh. Never #!/bin/sh with bashisms.
set -euo pipefail,trap-based cleanup, IFS discipline — and know where set -e does NOT fire.
"$var", "$@", "$(cmd)". Build commands with arrays,never with string concatenation.
meaningful and documented in --help.
mktemp + trap cleanup, atomic writes viamv, check-before-create, flock if concurrent runs are possible.
shellcheck (treat all findings as blockers, suppress only with a justifyingcomment) and shfmt -d before declaring done.** If they are unavailable locally, state that and flag CI must run them.
--help always; --version for distributed tools; set -x behind aDEBUG/TRACE env guard, never unconditionally (secret leakage).
When reviewing existing shell scripts, hunt the defect classes in rules/ files bottom-up (each rules file ends with an audit checklist of grep patterns and ShellCheck codes). Run shellcheck -S style on every script if available; correlate findings with context — ShellCheck flags symptoms, you judge exploitability and blast radius.
Severity conventions:
| Severity | Meaning | Examples | |
|---|---|---|---|
| CRITICAL | Exploitable or data-destroying now | eval on untrusted input; unquoted var in rm -rf; secrets in argv/set -x; curl\ | bash of unpinned URL in prod |
| HIGH | Will corrupt/fail on realistic input or failure | unquoted expansions in destructive paths; missing set -e/error checks around critical steps; predictable temp files; non-atomic config writes; missing exec in entrypoint (signals lost) | |
| MEDIUM | Latent bug or fragility | parsing ls; which instead of command -v; missing pipefail; no -- separators; no timeouts on network calls; echo for variable data | |
| LOW | Style/maintainability with safety implications | missing local; [ ] where [[ ]] intended; missing readonly; inconsistent error messages |
Finding format:
[SEVERITY] file:line — short title (SCxxxx if applicable)
Evidence: the offending line(s), verbatim
Impact: what input/condition triggers it and what breaks
Fix: concrete replacement code| File | Covers | |
|---|---|---|
| rules/01-safety-baseline.md | Shebang discipline, set -euo pipefail and its real limitations, quoting & word-splitting bug catalog, arrays, IFS, traps & mktemp cleanup, [[ ]], printf, local/readonly, globbing pitfalls, never parse ls | |
| rules/02-robustness-correctness.md | Argument parsing (getopts/while-case, --help/--version), input validation, POSIX vs bash portability, stderr/exit-code discipline, PIPESTATUS, command -v, network timeouts & retries, flock & background jobs, idempotency & atomic writes, safe filename handling | |
| rules/03-security.md | eval/injection, secrets discipline (argv/env/set -x), PATH hygiene, sudo discipline, curl\ | bash both directions, temp-file races, umask, ShellCheck+shfmt in CI |
| rules/04-ci-and-operational.md | GitHub Actions shell pitfalls (${{ }} injection, multiline run, quoting in YAML), container entrypoints (exec, PID 1, privilege drop), Makefile shell gotchas, long-running script logging |
#!/usr/bin/env bash + set -euo pipefail on every bash script — and explicit errorhandling where -e is known not to fire (conditions, &&/||, command substitution in assignments-with-modifiers, process substitution).
"$var", "$@", "${arr[@]}", "$(cmd)". SC2086 is abug, not style.
"${args[@]}". Never accumulate acommand in a string and eval/word-split it.
trap cleanup EXIT with an idempotent cleanup function; temp paths only via mktemp.eval, bash -c, or sh -c with interpolated untrusted data; use -- beforepositional file/user arguments to every command that supports it.
set -x; set +x around sensitivesections; read secrets from files or fds.
script: failed to X: $detail); meaningful exit codes;never exit 0 on failure paths.
--fail, --max-time/timeouts, and bounded retries — never barecurl url | ....
find -print0 | xargs -0 / -exec ... +, while IFS= read -r,never iterate $(ls) or unquoted globs from variables.
without CI linting is unreviewed code.
${{ }} injection, action pinning → sota-devsecopssota-secrets-managementsota-sandboxing, sota-cloud-infrastructuresota-python / sota-golang~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.