ShellCheck

koalaman/shellcheckReviewed by AI

What it does

ShellCheck reads a bash or sh script without running it and lists the problems it finds: forgotten quotes, comparisons that are always true, misused commands, things that work in bash but not in sh. Each warning has a number with a long explanation on the project wiki. You can paste a script at shellcheck.net, run `shellcheck yourscript` in a terminal, see the warnings inside editors such as VS Code, Vim or Emacs, or add it to an automated build. It is free, GPL-3.0, and has existed since 2012.

How easy it is to install

A · download and open · Web

Windows C
macOS C
Linux C
Web A

Nothing to install on the web: "Paste a shell script on https://www.shellcheck.net for instant feedback", which the README calls the easiest way to try it. On a computer it stays at C because it is a terminal program with no window of its own: one command installs it (`winget install --id koalaman.shellcheck` on Windows, `brew install shellcheck` on macOS, `sudo apt install shellcheck` on Linux) and then you type `shellcheck yourscript` or wire it into your editor.

Numbers on GitHub

Stars: 40,266on Oct 31, 2026
Downloads: 65,477,1501,157,316 this week
Growth: +22stars in 5 days

Stars over time

Facts

Runs on: Web, Windows, macOS, Linux
You need to install: Nothing extra
Disk space: not determined
Accounts or keys: None
Cost: Free · Free and GPL-3.0; contributions must be GPLv3 as well. The website and all packages cost nothing.
License: GPL-3.0 (Copyleft)
Last update: Oct 26, 2026

Risk signals (4)

Attentionthe web version sends your script to someone elses server
README: "Paste a shell script on https://www.shellcheck.net for instant feedback" and that site "is always synchronized to the latest git commit". Anything in the script you paste — server names, paths, keys — leaves your computer. The local install does not need the internet.
AI review
Infonew versions can break an automated build
README: "It's a good idea to manually install a specific ShellCheck version regardless. This avoids any surprise build breaks when a new version with new warnings is published." If you make a build fail on warnings, pin the version.
AI review
Infolast release is from 2025 while the code keeps moving
The newest release is v0.11.0 from 2025-08-04, but the last commit is from 2026-10-26, and there are 1089 open issues against 40262 stars. Only 30 releases in 14 years: the project is alive but publishes rarely, so your package manager's version may be well behind the code.
AI review
Infoextra fiddling on windows
README: on native Windows "the system may use a legacy codepage", so you have to pick a TrueType font and run `chcp 65001`, plus an extra encoding line in PowerShell ISE, otherwise the output is mangled.
AI review

Evidence is shown in its original language.

What Radar could not check

Whether it finds the particular bug in your script: it only reads the text and never runs it
How many of its warnings are beside the point in your script, which only you can judge
Whether shellcheck.net keeps or logs the scripts people paste
Which version your package manager gives you, which can be older than v0.11.0
Disk use, which the automatic check could not determine, although the downloads are 2 to 14 MB