rules-bash

Inline environment variable override detected. Verify this doesn't accidentally override a production or security-sensitive variable.

sudo command detected. Escalating privileges can make changes that are hard to reverse and affect the entire system.

RISK: an unchecked 'cd' that fails leaves the script running in the wrong directory — subsequent 'rm', 'cp', or build commands then act on the parent's cwd (ShellCheck SC2164). FIX: chain failure handling: 'cd "$dir" || exit 1', or enable 'set -e' and quote the argument.

RISK: disabling TLS verification (curl -k / wget --no-check-certificate) enables MITM tampering — exactly the supply-chain vector behind incidents like xz CVE-2024-3094 and curl CVE-2024-7264. FIX: remove the flag; if a custom CA is needed, pass it explicitly with '--cacert /path/to/ca.pem'.

RISK: backtick command substitution is hard to nest, easy to confuse with quotes, and discouraged by the Google Shell Style Guide. FIX: use the modern '$(command)' form, which nests cleanly and is unambiguous.

RISK: 'echo $VAR' misinterprets leading dashes as flags and processes backslash escapes inconsistently across shells (Google Shell Style Guide). FIX: use 'printf %s\n "$VAR"' for predictable, portable output.

RISK: 'eval' on a variable is a command-injection sink — attacker-controlled input runs with the script's privileges. FIX: avoid 'eval'; use a 'case' dispatch, an associative-array lookup, or arrays ("${cmd[@]}") to build commands without re-parsing.

RISK: an unquoted heredoc delimiter ('<<EOF') expands $vars and $(cmd) inside the body — when the body contains untrusted text this becomes command injection. FIX: quote the opener ('<<\'EOF\'' or '<<"EOF"') whenever the body is meant to be literal.

RISK: 'mktemp /tmp/fixed-name' (no XXXXXX template) is predictable and vulnerable to symlink/TOCTOU races on shared systems. FIX: pass a template with at least six trailing X's, e.g. 'mktemp /tmp/myapp.XXXXXXXX' or 'mktemp -d -t myapp.XXXXXXXX'.

RISK: 'local x=$(cmd)' always returns 0 because 'local' itself succeeds, silently swallowing the subshell's failure even under 'set -e' (ShellCheck SC2155). FIX: split the declaration: 'local x; x=$(cmd)' so the assignment exit status propagates.

RISK: 'rm -rf "$dir/"' wipes the filesystem root if $dir is empty or unset (ShellCheck SC2115). FIX: assert non-empty first with '${dir:?dir is required}' so the expansion aborts instead of resolving to '/'.

RISK: sourcing a variable path ('source $FILE') loads arbitrary code into the current shell — attacker control of the variable means RCE with the script's privileges. FIX: hard-code the path, validate against a strict allowlist before sourcing, and always quote ('source "$FILE"').

RISK: 'sudo bash' (or 'sudo sh') grants root to an interactive/arbitrary shell, bypassing any sudoers command restrictions. FIX: invoke the specific binary with explicit arguments under sudo, and pin the allowed commands in /etc/sudoers.

RISK: 'for f in $VAR' triggers word-splitting and pathname expansion, so the loop iterates over unintended tokens or matched files (ShellCheck SC2066/SC2086). FIX: quote ('for f in "$VAR"') or, for lists, iterate over an array with 'for f in "${arr[@]}"'.

Bash scripts should generally use 'set -e' or 'set -euo pipefail' to exit immediately if a command fails, preventing cascading errors.

Using 'rm -rf' with an unquoted variable (e.g. rm -rf $DIR) can lead to catastrophic deletion if the variable is empty or contains spaces (resolving to 'rm -rf /' or similar). Always quote the variable: rm -rf "$DIR", and check if it is empty first.

Background process started. Ensure the process is tracked and can be stopped cleanly — background jobs are easy to lose track of.

chmod 777 grants world-writable permissions and is a security risk. Use the minimum permissions needed (e.g., 755 for executables, 644 for files).

Piping curl/wget directly into a shell is a remote code execution risk. Download the script first, inspect it, then run it explicitly.

Bulk staging all files (-A / .) is risky: secrets, binaries, and debug artifacts can land in the commit by accident. Confirm the working tree is clean before approving, or use 'git add <specific-files>' instead.

SIGKILL (-9) bypasses graceful shutdown and may leave resources in a dirty state. Try SIGTERM first: kill <pid> or kill -15 <pid>.

Global npm installs modify the system environment outside the project and can cause version conflicts. Use a local install or npx instead.

Recursive delete is blocked. Use 'trash' or 'rm -i' for interactive confirmation, or specify exact files to remove.

Stderr merged into stdout via 2>&1. Standard shell idiom — only worth flagging when debugging output capture issues. Disabled by default; enable in .sigmashake/config.toml if you want a paper trail.