bash-script-hardening

# Bash Script Hardening ## Overview Most Bash bugs are silent: an unset variable expands to nothing, a failed command is ignored, an unquoted path word-splits, and the script marches on corrupting state. This skill makes Bash scripts **fail loudly, fail early, and clean up after themselves**. Keywords: bash, shell, strict mode, `set -euo pipefail`, IFS, quoting, word splitting, globbing, ShellCheck, trap, ERR, EXIT, cleanup, mktemp, signal handling, defensive scripting, POSIX, exit codes, here-doc, arrays. Use this skill to author a new script from a hardened template, retrofit an existing script, or review a script for safety defects. ## Workflow 1. **Set the shebang and strict mode.** Use `#!/usr/bin/env bash` and the canonical strict-mode preamble (see below). Never rely on `/bin/sh` if Bash features are used. 2. **Lock down word splitting.** Set `IFS=$'\n\t'` so unquoted expansions don't split on spaces. 3. **Quote everything.** Every variable expansion and command substitution gets double quotes unless you have a deliberate, commented reason not to. 4. **Use arrays for lists and command arguments.** Never build commands by concatenating strings. 5. **Add a cleanup trap.** Register an `EXIT` trap that removes temp files and restores state, plus an `ERR` trap for diagnostics. 6. **Handle errors explicitly where strict mode is insufficient** (conditionals, command substitution in older Bash, pipelines you intend to tolerate). 7. **Create temp files safely** with `mkte...