ShellCheck: The Static Analysis Tool That Catches Shell Script Bugs Before They Run

The problem nobody talks about until production breaks

Shell scripts look simple. They are just commands in a file, right?

Except they are not. Quoting issues, undefined variables, unexpected exit codes — these things sit quietly in your scripts until a specific condition triggers them at 2am. By then it is not a script issue, it is an incident.

What ShellCheck does

ShellCheck (koalaman/shellcheck) is a static analysis tool for bash and sh scripts. You point it at a file and it tells you where your script will misbehave — before you run it.

It integrates with editors via LSP, VS Code, and can run in CI pipelines through CodeClimate or Codacy. It runs on pull requests and fails the build when it finds problems.

A real example

Here is a script that looks reasonable at first glance:

#!/bin/bash
cp /data/backup.tar.gz /backup/
rm -rf /data/backup.tar.gz

ShellCheck catches three things here:

The rm -rf has no error handling — if the copy fails, you have just deleted your backup
No quotes around the paths — spaces in filenames will break this
No set -e or explicit exit code checks — the script continues even if cp fails

Those are not theoretical concerns. They are the kind of thing that causes real data loss.

How to use it

Install it via your package manager or download from shellcheck.net, then run:

shellcheck my_script.sh

It outputs line numbers, issue codes (SC####), and a plain-English explanation of the problem. For CI, add it to your pipeline and fail the build on errors. It takes about 30 seconds to set up and catches the kind of mistakes that are embarrassing to explain in a post-mortem.

The takeaway

Shell scripts are automation. Automation runs in production. Production is not the place to discover that your quoting was wrong. Run ShellCheck before the script runs anywhere that matters.

Tool: ShellCheck (github.com/koalaman/shellcheck)