# Verifying Shell changes Files: `.sh`, `.bash`, `.zsh`. Derived from 2 scanned source repositories and 70 review prompts on https://awesomereviewers.com. Page: https://awesomereviewers.com/verify/shell/ How to use this: run every check under *Run on every change*. Then, for each section under *Add when the change touches* that describes your diff, run its checks too. Checks catch what a tool can find; then apply the listed review prompts for what tools miss (fetch each prompt's raw URL). Usage is the share of scanned repositories in this language that run the tool. A missing tool means no scanned repository runs one the scanner recognises: fall back to the prompts. ## Run on every change - **Formatting** — no tool detected in the sample. Catches: Layout drift that buries the real change in the diff. - **Linting** — no tool detected in the sample. Catches: Bug-prone patterns, unused code and conventions the formatter does not cover. - **Type checking** — no tool detected in the sample. Catches: Wrong types, unhandled null or None, call signatures broken across modules. - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. Review prompts (6 in total, most discussed first): - [Avoid variable name abbreviations](https://awesomereviewers.com/raw/brew-avoid-variable-name-abbreviations.md) — Homebrew/brew, Naming Conventions - [Standardize shell flags](https://awesomereviewers.com/raw/chef-standardize-shell-flags.md) — chef/chef, Code Style - [Ensure cross-platform compatibility](https://awesomereviewers.com/raw/opengrep-ensure-cross-platform-compatibility.md) — opengrep/opengrep, Code Style - [Quote shell variables](https://awesomereviewers.com/raw/airflow-quote-shell-variables.md) — apache/airflow, Code Style - [Consistent variable naming](https://awesomereviewers.com/raw/tensorflow-consistent-variable-naming.md) — tensorflow/tensorflow, Naming Conventions - [improve code readability](https://awesomereviewers.com/raw/unstructured-improve-code-readability.md) — Unstructured-IO/unstructured, Code Style ## Add when the change touches ### Authentication, input handling, secrets, permissions - **Security scanning**: `semgrep` (50% of repos). Runs via pre-commit hook semgrep. Docs: https://github.com/semgrep/semgrep - **Secret scanning** — no tool detected in the sample. Catches: Credentials and tokens committed to the repository. - **Dependency audit** — no tool detected in the sample. Catches: Known-vulnerable or disallowed dependencies and licenses. Review prompts (14 in total, most discussed first): - [Validate security context](https://awesomereviewers.com/raw/bifrost-validate-security-context.md) — maximhq/bifrost, Security - [avoid runtime credential resolution](https://awesomereviewers.com/raw/electron-avoid-runtime-credential-resolution.md) — electron/electron, Security - [Enforce Sensitive File Permissions](https://awesomereviewers.com/raw/herdr-enforce-sensitive-file-permissions.md) — ogulcancelik/herdr, Security - [Least-privilege secret scoping](https://awesomereviewers.com/raw/agentcore-samples-least-privilege-secret-scoping.md) — awslabs/agentcore-samples, Security - [Preserve signing entitlements](https://awesomereviewers.com/raw/hermes-agent-preserve-signing-entitlements.md) — nousresearch/hermes-agent, Security - [Secure env lookup](https://awesomereviewers.com/raw/last30days-skill-secure-env-lookup.md) — mvanhorn/last30days-skill, Security - [Verify Download Integrity](https://awesomereviewers.com/raw/apisix-verify-download-integrity.md) — apache/apisix, Security - [Check Privilege Early](https://awesomereviewers.com/raw/container-check-privilege-early.md) — apple/container, Security - [Sanitize untrusted tags](https://awesomereviewers.com/raw/agent-zero-sanitize-untrusted-tags.md) — agent0ai/agent-zero, Security - [Least privilege networking](https://awesomereviewers.com/raw/claude-code-least-privilege-networking.md) — anthropics/claude-code, Security - [Warn against sudo](https://awesomereviewers.com/raw/zed-warn-against-sudo.md) — zed-industries/zed, Security - [Avoid automatic package execution](https://awesomereviewers.com/raw/langfuse-avoid-automatic-package-execution.md) — langfuse/langfuse, Security ### Public APIs, signatures, error paths, nullability - **Type checking** — no tool detected in the sample. Catches: Wrong types, unhandled null or None, call signatures broken across modules. - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. - **Property-based tests** — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data. Review prompts (9 in total, most discussed first): - [Config-Aware Startup Failures](https://awesomereviewers.com/raw/bifrost-config-aware-startup-failures.md) — maximhq/bifrost, Error Handling - [Fail Loudly, Degrade Safely](https://awesomereviewers.com/raw/aidlc-workflows-fail-loudly-degrade-safely.md) — awslabs/aidlc-workflows, Error Handling - [contextual failure handling](https://awesomereviewers.com/raw/opengrep-contextual-failure-handling.md) — opengrep/opengrep, Error Handling - [Fail with messages](https://awesomereviewers.com/raw/brew-fail-with-messages.md) — Homebrew/brew, Error Handling - [Secure API URL parsing](https://awesomereviewers.com/raw/brew-secure-api-url-parsing.md) — Homebrew/brew, API - [Fail-fast artifact downloads](https://awesomereviewers.com/raw/apisix-fail-fast-artifact-downloads.md) — apache/apisix, Error Handling - [Standardize bash error-handling](https://awesomereviewers.com/raw/chef-standardize-bash-error-handling.md) — chef/chef, Error Handling - [Fail fast principle](https://awesomereviewers.com/raw/claude-code-fail-fast-principle.md) — anthropics/claude-code, Error Handling - [Validate API parameter formats](https://awesomereviewers.com/raw/unstructured-validate-api-parameter-formats.md) — Unstructured-IO/unstructured, API ### Service and framework code - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. - **Version and platform matrix** — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally. ### Algorithms, parsers, data transforms - **Property-based tests** — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data. - **Fuzzing** — no tool detected in the sample. Catches: Crashes, panics and hangs on malformed input, especially in parsers and decoders. - **Mutation testing** — no tool detected in the sample. Catches: Tests that keep passing whatever the code does. - **Proofs and specifications** — no tool detected in the sample. Catches: Design-level bugs in protocols and algorithms, checked against a specification. Review prompts (1 in total, most discussed first): - [leverage standard algorithms](https://awesomereviewers.com/raw/prometheus-leverage-standard-algorithms.md) — prometheus/prometheus, Algorithms ### Threads, async code, locks, shared state - **Concurrency model checking** — no tool detected in the sample. Catches: Races and orderings that fail only under specific interleavings. - **Undefined-behaviour detection** — no tool detected in the sample. Catches: Memory-safety and aliasing violations in unsafe code. - **Property-based tests** — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data. Review prompts (1 in total, most discussed first): - [Safe lock reclamation](https://awesomereviewers.com/raw/cline-safe-lock-reclamation.md) — cline/cline, Concurrency ### Network calls, retries, timeouts, protocols - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. - **Fuzzing** — no tool detected in the sample. Catches: Crashes, panics and hangs on malformed input, especially in parsers and decoders. Review prompts (2 in total, most discussed first): - [Verify platform compatibility first](https://awesomereviewers.com/raw/tensorflow-verify-platform-compatibility-first.md) — tensorflow/tensorflow, Networking - [Optimize git network operations](https://awesomereviewers.com/raw/openpilot-optimize-git-network-operations.md) — commaai/openpilot, Networking ### UI components and pages - **End-to-end browser tests** — no tool detected in the sample. Catches: User flows broken across components, routing and the network. - **Linting** — no tool detected in the sample. Catches: Bug-prone patterns, unused code and conventions the formatter does not cover. ### Databases, migrations, caching - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. - **Version and platform matrix** — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally. Review prompts (1 in total, most discussed first): - [Descriptive migration functions](https://awesomereviewers.com/raw/terraform-descriptive-migration-functions.md) — hashicorp/terraform, Migrations ### Model, prompt and LLM code - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. Review prompts (3 in total, most discussed first): - [Remove redundant AI commands](https://awesomereviewers.com/raw/lmcache-remove-redundant-ai-commands.md) — LMCache/LMCache, AI - [Model precision matters](https://awesomereviewers.com/raw/ollama-model-precision-matters.md) — ollama/ollama, AI - [embedding provider configuration](https://awesomereviewers.com/raw/unstructured-embedding-provider-configuration.md) — Unstructured-IO/unstructured, AI ### CI workflows and configuration files - **CI workflow linting** — no tool detected in the sample. Catches: Broken GitHub Actions syntax, script injection, over-broad token permissions. - **File hygiene**: `pre-commit-hooks` (50% of repos). Runs via pre-commit hook check-ast. Autofixes. Docs: https://github.com/pre-commit/pre-commit-hooks Review prompts (31 in total, most discussed first): - [Externalize configuration values](https://awesomereviewers.com/raw/chef-externalize-configuration-values.md) — chef/chef, Configurations - [Environment variable patterns](https://awesomereviewers.com/raw/unstructured-environment-variable-patterns.md) — Unstructured-IO/unstructured, Configurations - [Avoid hard-coded configuration](https://awesomereviewers.com/raw/codex-avoid-hard-coded-configuration.md) — openai/codex, Configurations - [Safe Configuration Handling](https://awesomereviewers.com/raw/hermes-agent-safe-configuration-handling.md) — nousresearch/hermes-agent, Configurations - [Consistent env config](https://awesomereviewers.com/raw/agentcore-samples-consistent-env-config.md) — awslabs/agentcore-samples, Configurations - [Safe configuration defaults](https://awesomereviewers.com/raw/nanochat-safe-configuration-defaults.md) — karpathy/nanochat, Configurations - [optimize CI/CD pipelines](https://awesomereviewers.com/raw/lmcache-optimize-cicd-pipelines.md) — LMCache/LMCache, CI/CD - [Pin dependency versions](https://awesomereviewers.com/raw/openpilot-pin-dependency-versions.md) — commaai/openpilot, Configurations - [Export environment variables once](https://awesomereviewers.com/raw/node-export-environment-variables-once.md) — nodejs/node, Configurations - [Environment-aware configuration testing](https://awesomereviewers.com/raw/bazel-environment-aware-configuration-testing.md) — bazelbuild/bazel, Configurations - [Environment variable safety](https://awesomereviewers.com/raw/brew-environment-variable-safety.md) — Homebrew/brew, Configurations - [Use portable path configurations](https://awesomereviewers.com/raw/ollama-use-portable-path-configurations.md) — ollama/ollama, Configurations ### Dependencies and lockfiles - **Dependency audit** — no tool detected in the sample. Catches: Known-vulnerable or disallowed dependencies and licenses. - **Lockfile consistency** — no tool detected in the sample. Catches: A lockfile that no longer matches its manifest. - **Version and platform matrix** — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally. ### The tests themselves - **Mutation testing** — no tool detected in the sample. Catches: Tests that keep passing whatever the code does. - **Version and platform matrix** — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally. Review prompts (2 in total, most discussed first): - [Write specific test assertions](https://awesomereviewers.com/raw/bazel-write-specific-test-assertions.md) — bazelbuild/bazel, Testing - [Use proper testing frameworks](https://awesomereviewers.com/raw/opentelemetry-python-use-proper-testing-frameworks.md) — open-telemetry/opentelemetry-python, Testing ### Documentation and comments - **Docs build** — no tool detected in the sample. Catches: Broken cross-references, links and markup in documentation. - **Spelling** — no tool detected in the sample. Catches: Typos in identifiers, comments and docs. ## Source repositories [anthropics/claude-code](https://awesomereviewers.com/sources/anthropics-claude-code/), [opengrep/opengrep](https://awesomereviewers.com/sources/opengrep-opengrep/)