Lint Bash and sh Scripts

What this tool does

Paste a bash, sh, dash or zsh script and get a static lint report without running the script. The checker focuses on high-signal shell pitfalls that are easy to miss in review: unquoted variable expansions, missing strict mode, useless cat, legacy backticks, pipe-to-while subshell scope traps, unchecked cd, parsing ls, spaced assignments, risky rm -rf paths, simple block/quote syntax mismatches and POSIX-shell bashisms.

Each finding includes a line number, severity, rule code, message and the source line that triggered it. Use Text report while editing, or JSON for CI when you want summary counts and a machine-readable findings array.

Worked example

Input:

#!/usr/bin/env bash
name=$1
echo Hello $name
for f in $(ls *.txt); do
  cat $f | while read line; do
    echo $line
  done
done

Typical output:

Shell: bash
Findings: 6 (0 errors, 5 warnings, 1 info)

L2 [warning] STRICT-MODE: missing strict mode: set -e, set -u, set -o pipefail
  name=$1
L3 [warning] UNQUOTED-VAR: quote variable expansions to avoid word splitting and globbing
  echo Hello $name
L4 [warning] PARSE-LS: do not parse ls output; glob directly or use find -print0/read -d ''
  for f in $(ls *.txt); do
L5 [info] USELESS-CAT: useless use of cat; redirect the file into the consumer instead
  cat $f | while read line; do
L5 [warning] SUBSHELL-SCOPE: commands after a pipeline run in a subshell in many shells; variables assigned in the loop are lost
  cat $f | while read line; do
L6 [warning] UNQUOTED-VAR: quote variable expansions to avoid word splitting and globbing
  echo $line

The script is never executed; only its text is scanned. Comments, single-quoted strings and here-doc bodies are masked before linting so examples in documentation do not produce findings.

Rule codes

Limits and edge cases

• This is a lightweight, deterministic pitfall checker, not a full shell parser. Keep a full linter in CI for production-critical scripts.
• The shell = auto mode reads the shebang and falls back to bash when there is none. Choose sh or dash to enable POSIX bashism checks.
• ignore accepts comma- or space-separated rule codes, such as LEGACY-TEST, USELESS-CAT.
• Input is capped at 200,000 bytes so the browser page stays responsive.
• Here-doc bodies, comments and single-quoted strings are masked. Double-quoted strings are still scanned because expansions inside them are meaningful.
• The checker reports one finding per rule per line to keep the output readable.
• It does not apply fixes. Shell rewriting needs an exact AST and source ranges; this tool reports the issue and leaves the edit to you.

FAQ