hermeticormus Shell safety
Apply to every shell script written or modified.
Boilerplate every script needs
#!/usr/bin/env bash
set -euo pipefail
IFS=$'\n\t'
Always
- Quote variable expansions:
"$var","$@" [[ ... ]]over[ ... ](( ... ))for numeric- Arrays for argument lists, expand
"${args[@]}" done < <(cmd)notcmd | while readrm -rf "${var:?}/..."for destructive ops
Never
- Missing shebang
- Missing
set -euo pipefail - Unquoted variable expansion
cdwithout checkrm -rf "$var/"without${var:?}eval(almost always wrong)for line in $(cat file)— usewhile IFS= read -r line < fileechoon untrusted data — useprintf '%s\n'
Full content + 15 worked failure-mode examples at https://github.com/HermeticOrmus/shell-safety-skills.