菜单
Shell script static analysis using ShellCheck. Detects command injection, unquoted variables, reverse shell patterns, dangerous rm operations, obfuscated payloads. Combine with graudit for patterns ShellCheck may miss.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Python AST-based security analysis using Bandit. Detects exec/eval code execution, pickle/yaml deserialization, subprocess shell injection, SQL injection, hardcoded credentials, weak cryptography. Use for Python security audits, malicious code triage.
Multi-language pattern-based security scanner using grep signature databases. Primary use for secrets detection, command injection patterns, and first-pass security scans on unknown codebases. Supports 15+ languages.
Detect malicious packages and supply chain attacks in Python (PyPI) and Node.js (npm). Scans requirements.txt, package.json, package-lock.json for malware, typosquatting, data exfiltration, and compromised maintainers.
Comprehensive security scanner for filesystems, container images, and IaC. Detects known CVEs in dependencies, hardcoded secrets, and IaC misconfigurations in Terraform, Kubernetes, Dockerfiles, and CloudFormation.
Domain knowledge for extracting headlines from major international news outlets. Covers which tool to use per site, URL patterns, timestamp formats, and filtering rules.
| name | shellcheck-security-scan |
| description | Shell script static analysis using ShellCheck. Detects command injection, unquoted variables, reverse shell patterns, dangerous rm operations, obfuscated payloads. Combine with graudit for patterns ShellCheck may miss. |
| applyTo | **/*.sh,**/*.bash |
ShellCheck is a static analysis tool for shell scripts (bash, sh, dash, ksh). It identifies bugs, security vulnerabilities, and dangerous patterns.
# Scan a single script
shellcheck script.sh
# Scan with all checks enabled and warning threshold
shellcheck --enable=all --severity=warning script.sh
# JSON output for parsing
shellcheck --enable=all --format=json script.sh
# Scan all scripts recursively
find . -name "*.sh" -exec shellcheck --enable=all --severity=warning {} +
# SARIF output for security tools
shellcheck --format=sarif --enable=all script.sh
# Specify shell dialect
shellcheck --shell=bash script.sh
| Code | Pattern | Risk | MITRE ATT&CK |
|---|---|---|---|
| SC2086 | Unquoted variable in rm/curl | Command injection | T1059.004 |
| SC2046 | Unquoted command substitution | Command injection | T1059.004 |
| SC2091 | Executing command output $(...) | Arbitrary code execution | T1059.004 |
| SC2115 | Empty var + rm | Root filesystem wipe | T1485 |
| SC2216 | Pipe to rm | Arbitrary file deletion | T1070.004 |
| SC2029 | SSH command injection | Remote command confusion | T1021.004 |
| SC2087 | Unquoted heredoc | Data injection | T1059.004 |
ShellCheck misses obfuscated/malicious patterns. Also check:
# Reverse shells
grep -rn --include="*.sh" -E "(bash\s+-i|/dev/tcp/|nc\s+(-e|-c)|mkfifo)" .
# Download-and-execute
grep -rn --include="*.sh" -E "(curl|wget).*\|.*(ba)?sh" .
# Data exfiltration
grep -rn --include="*.sh" -E "curl.*-d.*\$|wget.*--post-data" .
# Obfuscated payloads
grep -rn --include="*.sh" -E "(base64\s+(-d|--decode)).*\|\s*(ba)?sh" .
# Persistence mechanisms
grep -rn --include="*.sh" -E "(crontab|/etc/cron|systemctl.*enable|update-rc.d)" .