Bash Script Hardening

Bash Script Hardening

Overview

Most Bash bugs are silent: an unset variable expands to nothing, a failed command is ignored, an unquoted path word-splits, and the script marches on corrupting state. This skill makes Bash scripts fail loudly, fail early, and clean up after themselves.

Keywords: bash, shell, strict mode, set -euo pipefail, IFS, quoting, word splitting, globbing, ShellCheck, trap, ERR, EXIT, cleanup, mktemp, signal handling, defensive scripting, POSIX, exit codes, here-doc, arrays.

Use this skill to author a new script from a hardened template, retrofit an existing script, or review a script for safety defects.

Workflow

1. Set the shebang and strict mode. Use #!/usr/bin/env bash and the canonical strict-mode preamble (see below). Never rely on /bin/sh if Bash features are used.
2. Lock down word splitting. Set IFS=$'\n\t' so unquoted expansions don't split on spaces.
3. Quote everything. Every variable expansion and command substitution gets double quotes unless you have a deliberate, commented reason not to.
4. Use arrays for lists and command arguments. Never build commands by concatenating strings.
5. Add a cleanup trap. Register an EXIT trap that removes temp files and restores state, plus an ERR trap for diagnostics.
6. Handle errors explicitly where strict mode is insufficient (conditionals, command substitution in older Bash, pipelines you intend to tolerate).
7. Create temp files safely with mktemp, and reference them through the cleanup trap.
8. Validate inputs and dependencies up front: required args, required commands (command -v), required env vars.
9. Run ShellCheck and resolve every finding; suppress only with a justified # shellcheck disable=SCxxxx comment.
10. Test failure paths, not just the happy path.

Reference files:

• references/strict-mode.md — deep dive on set -euo pipefail, IFS, and the gotchas/escape hatches.
• references/shellcheck-codes.md — the most common ShellCheck codes, what they mean, and the correct fix.
• templates/hardened-script.sh — drop-in starting template with strict mode, traps, arg parsing, logging.
• scripts/harden_check.sh — static auditor that flags missing strict mode, unquoted vars, and other red flags.
• examples/before-after.md — a real fragile script transformed into a hardened one, line by line.

The canonical strict-mode preamble

#!/usr/bin/env bash
set -Eeuo pipefail
IFS=$'\n\t'

What each flag buys you: