Nothing to hand? Load the — no strict mode, an unguarded rm -rf on an unvalidated variable, a literal token, backticks and a curl piped into sh — or the , where the correct verdict is production-ready and the useful output is what to add next.
Paste the script — the prescan is free
No upload, no AI: the prescan reads every file in your browser and lists what it mechanically found. The file and function inventory, then the flags — missing or incomplete strict mode, rm -rf on a variable path, downloads piped into a shell, eval on dynamic content, backtick substitution, unquoted $@, read without -r, loops over ls output, unguarded cd, fixed /tmp paths, mktemp without a cleanup trap, secret-looking literals, chmod 777 and sudo mid-script. Each group explains why it matters. This part costs nothing and happens while you type.
The AI reviews it — this is the metered part
A senior infrastructure engineer's pass: a production-readiness posture with the single most important change named, the inventory with each file's and function's role, and prioritized findings across correctness, security, robustness, portability, performance, maintainability and hygiene — each with the problem, the concrete impact, the fix and a corrected shell fragment. Every prescan flag is confirmed or explicitly set aside. Findings may only cite files, functions and commands that actually appear in your paste. Pricing is honest: a worst-case amount is reserved before the run and only what the run actually uses is charged — the meter next to the button shows both.
Fix, export, re-run
Take the fixes away, do not retype them: download your own script back with every finding injected as a comment on the line it is about, copy all the corrected fragments as one ordered block, or export the findings table as CSV with the snippets included. Review history is saved to your SkillSafe account when you are signed in, so a review you ran on one machine is there on the next one — restore it, patch the script, re-review, and the app tells you which mechanical flags you cleared, which are still open and which are new, for free.
Derived from the @wshobson/bash-defensive-patterns skill (MIT license).