메뉴
Shell script static analysis using ShellCheck. Detects command injection, unquoted variables, reverse shell patterns, dangerous rm operations, obfuscated payloads. Combine with graudit for patterns ShellCheck may miss.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Python AST-based security analysis using Bandit. Detects exec/eval code execution, pickle/yaml deserialization, subprocess shell injection, SQL injection, hardcoded credentials, weak cryptography. Use for Python security audits, malicious code triage.
Multi-language pattern-based security scanner using grep signature databases. Primary use for secrets detection, command injection patterns, and first-pass security scans on unknown codebases. Supports 15+ languages.
Detect malicious packages and supply chain attacks in Python (PyPI) and Node.js (npm). Scans requirements.txt, package.json, package-lock.json for malware, typosquatting, data exfiltration, and compromised maintainers.
Comprehensive security scanner for filesystems, container images, and IaC. Detects known CVEs in dependencies, hardcoded secrets, and IaC misconfigurations in Terraform, Kubernetes, Dockerfiles, and CloudFormation.
Domain knowledge for extracting headlines from major international news outlets. Covers which tool to use per site, URL patterns, timestamp formats, and filtering rules.
| name | shellcheck-security-scan |
| description | Shell script static analysis using ShellCheck. Detects command injection, unquoted variables, reverse shell patterns, dangerous rm operations, obfuscated payloads. Combine with graudit for patterns ShellCheck may miss. |
| applyTo | **/*.sh,**/*.bash |
ShellCheck is a static analysis tool for shell scripts (bash, sh, dash, ksh). It identifies bugs, security vulnerabilities, and dangerous patterns.
# Scan a single script
shellcheck script.sh
# Scan with all checks enabled and warning threshold
shellcheck --enable=all --severity=warning script.sh
# JSON output for parsing
shellcheck --enable=all --format=json script.sh
# Scan all scripts recursively
find . -name "*.sh" -exec shellcheck --enable=all --severity=warning {} +
# SARIF output for security tools
shellcheck --format=sarif --enable=all script.sh
# Specify shell dialect
shellcheck --shell=bash script.sh
| Code | Pattern | Risk | MITRE ATT&CK |
|---|---|---|---|
| SC2086 | Unquoted variable in rm/curl | Command injection | T1059.004 |
| SC2046 | Unquoted command substitution | Command injection | T1059.004 |
| SC2091 | Executing command output $(...) | Arbitrary code execution | T1059.004 |
| SC2115 | Empty var + rm | Root filesystem wipe | T1485 |
| SC2216 | Pipe to rm | Arbitrary file deletion | T1070.004 |
| SC2029 | SSH command injection | Remote command confusion | T1021.004 |
| SC2087 | Unquoted heredoc | Data injection | T1059.004 |
ShellCheck misses obfuscated/malicious patterns. Also check:
# Reverse shells
grep -rn --include="*.sh" -E "(bash\s+-i|/dev/tcp/|nc\s+(-e|-c)|mkfifo)" .
# Download-and-execute
grep -rn --include="*.sh" -E "(curl|wget).*\|.*(ba)?sh" .
# Data exfiltration
grep -rn --include="*.sh" -E "curl.*-d.*\$|wget.*--post-data" .
# Obfuscated payloads
grep -rn --include="*.sh" -E "(base64\s+(-d|--decode)).*\|\s*(ba)?sh" .
# Persistence mechanisms
grep -rn --include="*.sh" -E "(crontab|/etc/cron|systemctl.*enable|update-rc.d)" .