shellcheck-security-scan

Scan shell scripts for security issues using ShellCheck static analysis.

17|5|Updated Feb 1, 2026

Search Tags:#security #bash #shellcheck #shell #static-analysis #ci

Ready to run

npx skills add https://github.com/alxayo/sec-check --skill shellcheck-security-scan

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: shellcheck-security-scan
Source: https://github.com/alxayo/sec-check/tree/main/.github/skills/shellcheck-security-scan
Command: npx skills add https://github.com/alxayo/sec-check --skill shellcheck-security-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Shell scripts often harbor security and reliability issues that can lead to vulnerabilities or runtime failures when deployed. This Skill uses ShellCheck static analysis to detect command injection risks, unquoted variables, and other common shell pitfalls before code runs, helping teams ship safer scripts.

Core Features & Use Cases

Static analysis of Bash, Sh, Dash, and Ksh scripts for security vulnerabilities and coding mistakes
Recursive project scanning, including Dockerfiles and CI/CD workflow scripts
Flexible output formats (JSON, SARIF, GCC-like) for CI integration and reporting
Optional guidance for remediation and best practices

Quick Start

Run a ShellCheck security scan on your shell scripts to identify and fix vulnerabilities.

Frequently Asked Questions about shellcheck-security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find command injection vulnerabilities in bash scripts?▼

Static analysis identifies command injection vulnerabilities in bash scripts by detecting unquoted variables and common shell pitfalls before runtime. It scans for security issues that could lead to exploits when scripts are deployed in production environments.

Can I run ShellCheck static analysis on GitHub workflows and Dockerfiles?▼

Yes, ShellCheck static analysis recursively scans GitHub workflows and Dockerfiles alongside standard shell scripts. It processes Bash, Sh, Dash, and Ksh scripts across CI/CD pipelines and local projects to detect security flaws.

How do I generate SARIF output from a shell script security scan for CI integration?▼

Shell script security scans can output results in SARIF format for CI integration, alongside JSON and GCC-like formats. This allows automated security reporting and triage directly within your continuous integration pipelines.

What is the best way to prevent command injection in CI/CD shell scripts?▼

Preventing command injection in CI/CD shell scripts involves running static analysis to catch unquoted variables and unsafe command constructions. This process enables quick triage and remediation of security risks before code execution.

Does this shell static analysis tool support Ksh and Dash scripts?▼

Yes, this shell static analysis tool supports Ksh and Dash scripts, in addition to Bash and Sh. It applies consistent security vulnerability detection and coding mistake checks across all supported shell script types.

What are the limitations of using ShellCheck for security analysis?▼

ShellCheck focuses on static analysis for common shell pitfalls and command injection risks, but does not cover all runtime vulnerabilities. For broader coverage, it can be integrated with graudit to supplement its security scanning capabilities.