cfgaudit

Rules / CFG045

CFG045 ShellCheck analysis of hook / helper commands

Severity: error / warn / info (mapped from ShellCheck) OWASP: LLM03:2026 – Excessive Agency

What cfgaudit checks

The regex-based command rules (CFG008/009/014/015/027/028/037/038/039) catch structural patterns, but miss a large class of shell-level issues that need real grammar awareness — unquoted expansions, unsafe eval, dangerous pipes, etc. CFG045 runs ShellCheck over each command site (hooks and the command-running helpers) and surfaces its diagnostics, with the ShellCheck code (SC2086, SC2046, …) in the message.

ShellCheck severities map to cfgaudit severities: error → error, warning → warn, info/style → info.

Opt-in & requirements

CFG045 is off by default. Enable it with the --shellcheck flag or shellcheck: true in .cfgaudit.yml. It requires the shellcheck binary on PATH; when ShellCheck is requested but not installed, cfgaudit logs a warning to stderr and continues without shell analysis (no finding). The container image ships ShellCheck, so the GitHub Action and the GitLab components need nothing extra.

cfgaudit --shellcheck

# .cfgaudit.yml
shellcheck: true

Excluding ShellCheck codes

To accept one ShellCheck code without losing the rest of CFG045, list it under shellcheck-exclude. The codes are passed to ShellCheck as --exclude, so they are never reported. SC2086, sc2086 and 2086 all work; anything else is a config error (exit 2).

# .cfgaudit.yml
shellcheck: true
shellcheck-exclude: [SC2086, SC2164]

ShellCheck's own # shellcheck disable= directive does not reach a hook command: the command is a JSON string, which cfgaudit wraps in a script before passing it to ShellCheck. rules: { CFG045: off } acts on every ShellCheck code at once; shellcheck-exclude (above) drops single codes.

Example

A hook command rm $FILE yields an info finding referencing SC2086 ("Double quote to prevent globbing and word splitting").

Relationship to other rules

Complements, not replaces, the regex command rules — those run unconditionally and independently of ShellCheck availability; CFG045 adds deeper, grammar-aware analysis when enabled.

References

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation