ShellCheck

ShellCheck is a static analysis and linting tool for shell scripts, created by Vidar Holen (koalaman) in 2011. Written in Haskell, ShellCheck has become the de facto standard for shell script quality assurance, integrated into CI/CD pipelines, editors (VS Code, Vim, Emacs, IntelliJ, Atom, Sublime Text), and development workflows worldwide. With over 36,600 stars on its primary repository as of 2026, ShellCheck analyzes shell scripts for common programming errors, pitfalls, and bad practices that lead to bugs, security vulnerabilities, and portability issues. The tool supports POSIX sh, Bash (versions 3 through 5), Dash, Ksh, and Busybox ash. ShellCheck checks for over 200 categories of issues organized by severity (error, warning, info, style) including: unquoted variables that cause word splitting and glob expansion issues (SC2086), command substitution issues with trailing newlines (SC2046), use of deprecated or unsafe constructs (eval, backticks, [ vs [[), incorrect test operators (== in POSIX sh, = in Bash test), common mistakes with cd without checking return codes (SC2181), incorrect arithmetic expansion, variable assignment in pipelines (which runs in a subshell), race conditions with temporary files (recommending mktemp), insecure file permissions, echo portability issues, shebang issues (missing or incorrect #! lines), useless cat usage, suggest improvements for readability (SC2004: $ on arithmetic variables), and detect common security issues. ShellCheck provides inline directives (# shellcheck disable=SC2086) for suppressing specific checks on specific lines.