Curriculum: Shell Scripting
This curriculum structures a shell scripting workshop from fundamentals to advanced operations and security review. It combines language basics, practical scripting, tests, CI/CD and safe operational decisions.
Curriculum Goal
After the full series you can read, design, test, review and harden Bash scripts. You know the limits of shell scripts and can decide when Python, Go or a specialized tool is a better fit.
Teaching Model
The workshop follows a repeating cycle:
Understand -> Write -> Test -> Debug -> Harden -> Document
| Step | Goal | Typical Activity |
|---|---|---|
| Concept | understand semantics and limits | quoting rule, exit-code model, process model |
| Implementation | write a small script with a clear interface | shebang, usage, getopts, functions |
| Check | run syntax, linting and tests | bash -n, ShellCheck, smoke test |
| Error path | reproduce a known fault | missing file, invalid option, signal |
| Hardening | reduce risk | allowlist, mktemp, trap, absolute paths |
| Documentation | record operations and recovery | README, runbook, exit-code table |
Level Structure
| Level | Focus | Outcome |
|---|---|---|
| Fundamentals | Syntax, Ausführung, Quoting, Exit Codes, Dateien und erste sichere Skripte | You can explain, run and review the included script patterns. |
| Intermediate | CLI-Design, Funktionen, getopts, Textverarbeitung, Fehlerbehandlung und Cleanup | You can explain, run and review the included script patterns. |
| Professional | Skriptarchitektur, Tests, CI/CD, Packaging, Observability und teamfähige Standards | You can explain, run and review the included script patterns. |
| Advanced Security | Threat Modeling, Injection-Schutz, Secrets, Rechte, sichere Löschung und Incident Response | You can explain, run and review the included script patterns. |
Roles and Learning Paths
- Developers focus on CLI behavior, tests, CI and maintainability.
- Administrators focus on filesystems, processes, cron, systemd and recovery.
- DevOps and SRE roles focus on idempotence, observability, runners and safe automation.
- Security engineers focus on injection, secrets, permissions, PATH and auditability.
Lab Strategy
All labs run locally without production credentials. Each example creates a work/ directory, writes evidence files and can be repeated. Destructive operations are simulated or guarded by dry-run behavior.
Assessment Rubric
| Criterion | Basic | Good | Excellent |
|---|---|---|---|
| Correctness | script runs on the happy path | error paths are handled | behavior is tested and documented |
| Security | no obvious secrets | input is validated | destructive paths have multiple safeguards |
| Maintainability | readable structure | clear functions and usage | CI gates and runbook exist |
| Operations | manual execution works | logs and exit codes are useful | recovery has been practiced |
Sources and References
Review Checklist for Curriculum
- 01. name the shebang and target shell explicitly: Record the affected file, command, exit code and risk.
- 02. quote variable expansions unless word splitting is deliberate: Record the affected file, command, exit code and risk.
- 03. validate inputs before they influence filenames, options or commands: Record the affected file, command, exit code and risk.
- 04. evaluate and document exit codes explicitly: Record the affected file, command, exit code and risk.
- 05. separate stderr and stdout: Record the affected file, command, exit code and risk.
- 06. create temporary files with
mktemp: Record the affected file, command, exit code and risk. - 07. test cleanup through
trap: Record the affected file, command, exit code and risk. - 08. guard destructive operations with dry-run, scope checks and confirmation: Record the affected file, command, exit code and risk.
- 09. never print or commit secrets: Record the affected file, command, exit code and risk.
- 10. check PATH and external dependencies: Record the affected file, command, exit code and risk.
- 11. handle ShellCheck warnings or suppress them with a reason: Record the affected file, command, exit code and risk.
- 12. document portability assumptions between Bash and POSIX sh: Record the affected file, command, exit code and risk.
- 13. name the shebang and target shell explicitly: Record the affected file, command, exit code and risk.
- 14. quote variable expansions unless word splitting is deliberate: Record the affected file, command, exit code and risk.
- 15. validate inputs before they influence filenames, options or commands: Record the affected file, command, exit code and risk.
- 16. evaluate and document exit codes explicitly: Record the affected file, command, exit code and risk.
- 17. separate stderr and stdout: Record the affected file, command, exit code and risk.
- 18. create temporary files with
mktemp: Record the affected file, command, exit code and risk. - 19. test cleanup through
trap: Record the affected file, command, exit code and risk. - 20. guard destructive operations with dry-run, scope checks and confirmation: Record the affected file, command, exit code and risk.
- 21. never print or commit secrets: Record the affected file, command, exit code and risk.
- 22. check PATH and external dependencies: Record the affected file, command, exit code and risk.
- 23. handle ShellCheck warnings or suppress them with a reason: Record the affected file, command, exit code and risk.
- 24. document portability assumptions between Bash and POSIX sh: Record the affected file, command, exit code and risk.
- 25. name the shebang and target shell explicitly: Record the affected file, command, exit code and risk.
- 26. quote variable expansions unless word splitting is deliberate: Record the affected file, command, exit code and risk.
- 27. validate inputs before they influence filenames, options or commands: Record the affected file, command, exit code and risk.
- 28. evaluate and document exit codes explicitly: Record the affected file, command, exit code and risk.
- 29. separate stderr and stdout: Record the affected file, command, exit code and risk.
- 30. create temporary files with
mktemp: Record the affected file, command, exit code and risk. - 31. test cleanup through
trap: Record the affected file, command, exit code and risk. - 32. guard destructive operations with dry-run, scope checks and confirmation: Record the affected file, command, exit code and risk.
- 33. never print or commit secrets: Record the affected file, command, exit code and risk.
- 34. check PATH and external dependencies: Record the affected file, command, exit code and risk.
- 35. handle ShellCheck warnings or suppress them with a reason: Record the affected file, command, exit code and risk.
- 36. document portability assumptions between Bash and POSIX sh: Record the affected file, command, exit code and risk.
- 37. name the shebang and target shell explicitly: Record the affected file, command, exit code and risk.
- 38. quote variable expansions unless word splitting is deliberate: Record the affected file, command, exit code and risk.
- 39. validate inputs before they influence filenames, options or commands: Record the affected file, command, exit code and risk.
- 40. evaluate and document exit codes explicitly: Record the affected file, command, exit code and risk.
- 41. separate stderr and stdout: Record the affected file, command, exit code and risk.
- 42. create temporary files with
mktemp: Record the affected file, command, exit code and risk. - 43. test cleanup through
trap: Record the affected file, command, exit code and risk. - 44. guard destructive operations with dry-run, scope checks and confirmation: Record the affected file, command, exit code and risk.
- 45. never print or commit secrets: Record the affected file, command, exit code and risk.
- 46. check PATH and external dependencies: Record the affected file, command, exit code and risk.
- 47. handle ShellCheck warnings or suppress them with a reason: Record the affected file, command, exit code and risk.
- 48. document portability assumptions between Bash and POSIX sh: Record the affected file, command, exit code and risk.
- 49. name the shebang and target shell explicitly: Record the affected file, command, exit code and risk.
- 50. quote variable expansions unless word splitting is deliberate: Record the affected file, command, exit code and risk.
- 51. validate inputs before they influence filenames, options or commands: Record the affected file, command, exit code and risk.
- 52. evaluate and document exit codes explicitly: Record the affected file, command, exit code and risk.
- 53. separate stderr and stdout: Record the affected file, command, exit code and risk.
- 54. create temporary files with
mktemp: Record the affected file, command, exit code and risk. - 55. test cleanup through
trap: Record the affected file, command, exit code and risk. - 56. guard destructive operations with dry-run, scope checks and confirmation: Record the affected file, command, exit code and risk.
- 57. never print or commit secrets: Record the affected file, command, exit code and risk.
- 58. check PATH and external dependencies: Record the affected file, command, exit code and risk.
- 59. handle ShellCheck warnings or suppress them with a reason: Record the affected file, command, exit code and risk.
- 60. document portability assumptions between Bash and POSIX sh: Record the affected file, command, exit code and risk.
- 61. name the shebang and target shell explicitly: Record the affected file, command, exit code and risk.
- 62. quote variable expansions unless word splitting is deliberate: Record the affected file, command, exit code and risk.
- 63. validate inputs before they influence filenames, options or commands: Record the affected file, command, exit code and risk.
- 64. evaluate and document exit codes explicitly: Record the affected file, command, exit code and risk.
Practice Appendix: Curriculum
This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with Bash, test data and a Git repository.
A001. Interpreter
- Task: validate input and connect the observation explicitly to
Interpreter. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A002. Quoting
- Task: explain exit code and connect the observation explicitly to
Quoting. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A003. Exit Codes
- Task: check quoting and connect the observation explicitly to
Exit Codes. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A004. Files
- Task: test error path and connect the observation explicitly to
Files. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A005. Pipelines
- Task: review log output and connect the observation explicitly to
Pipelines. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A006. Testing
- Task: trace cleanup and connect the observation explicitly to
Testing. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A007. Security
- Task: scope portability and connect the observation explicitly to
Security. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A008. Operations
- Task: mark security risk and connect the observation explicitly to
Operations. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A009. Interpreter
- Task: document recovery path and connect the observation explicitly to
Interpreter. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A010. Quoting
- Task: write review rule and connect the observation explicitly to
Quoting. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A011. Exit Codes
- Task: validate input and connect the observation explicitly to
Exit Codes. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A012. Files
- Task: explain exit code and connect the observation explicitly to
Files. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A013. Pipelines
- Task: check quoting and connect the observation explicitly to
Pipelines. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A014. Testing
- Task: test error path and connect the observation explicitly to
Testing. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A015. Security
- Task: review log output and connect the observation explicitly to
Security. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A016. Operations
- Task: trace cleanup and connect the observation explicitly to
Operations. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A017. Interpreter
- Task: scope portability and connect the observation explicitly to
Interpreter. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A018. Quoting
- Task: mark security risk and connect the observation explicitly to
Quoting. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A019. Exit Codes
- Task: document recovery path and connect the observation explicitly to
Exit Codes. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A020. Files
- Task: write review rule and connect the observation explicitly to
Files. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A021. Pipelines
- Task: validate input and connect the observation explicitly to
Pipelines. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A022. Testing
- Task: explain exit code and connect the observation explicitly to
Testing. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A023. Security
- Task: check quoting and connect the observation explicitly to
Security. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A024. Operations
- Task: test error path and connect the observation explicitly to
Operations. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A025. Interpreter
- Task: review log output and connect the observation explicitly to
Interpreter. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A026. Quoting
- Task: trace cleanup and connect the observation explicitly to
Quoting. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A027. Exit Codes
- Task: scope portability and connect the observation explicitly to
Exit Codes. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A028. Files
- Task: mark security risk and connect the observation explicitly to
Files. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A029. Pipelines
- Task: document recovery path and connect the observation explicitly to
Pipelines. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A030. Testing
- Task: write review rule and connect the observation explicitly to
Testing. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A031. Security
- Task: validate input and connect the observation explicitly to
Security. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A032. Operations
- Task: explain exit code and connect the observation explicitly to
Operations. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A033. Interpreter
- Task: check quoting and connect the observation explicitly to
Interpreter. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A034. Quoting
- Task: test error path and connect the observation explicitly to
Quoting. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A035. Exit Codes
- Task: review log output and connect the observation explicitly to
Exit Codes. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A036. Files
- Task: trace cleanup and connect the observation explicitly to
Files. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A037. Pipelines
- Task: scope portability and connect the observation explicitly to
Pipelines. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A038. Testing
- Task: mark security risk and connect the observation explicitly to
Testing. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A039. Security
- Task: document recovery path and connect the observation explicitly to
Security. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A040. Operations
- Task: write review rule and connect the observation explicitly to
Operations. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A041. Interpreter
- Task: validate input and connect the observation explicitly to
Interpreter. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A042. Quoting
- Task: explain exit code and connect the observation explicitly to
Quoting. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A043. Exit Codes
- Task: check quoting and connect the observation explicitly to
Exit Codes. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A044. Files
- Task: test error path and connect the observation explicitly to
Files. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A045. Pipelines
- Task: review log output and connect the observation explicitly to
Pipelines. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A046. Testing
- Task: trace cleanup and connect the observation explicitly to
Testing. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A047. Security
- Task: scope portability and connect the observation explicitly to
Security. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A048. Operations
- Task: mark security risk and connect the observation explicitly to
Operations. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A049. Interpreter
- Task: document recovery path and connect the observation explicitly to
Interpreter. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A050. Quoting
- Task: write review rule and connect the observation explicitly to
Quoting. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A051. Exit Codes
- Task: validate input and connect the observation explicitly to
Exit Codes. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A052. Files
- Task: explain exit code and connect the observation explicitly to
Files. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A053. Pipelines
- Task: check quoting and connect the observation explicitly to
Pipelines. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A054. Testing
- Task: test error path and connect the observation explicitly to
Testing. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A055. Security
- Task: review log output and connect the observation explicitly to
Security. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A056. Operations
- Task: trace cleanup and connect the observation explicitly to
Operations. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A057. Interpreter
- Task: scope portability and connect the observation explicitly to
Interpreter. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A058. Quoting
- Task: mark security risk and connect the observation explicitly to
Quoting. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A059. Exit Codes
- Task: document recovery path and connect the observation explicitly to
Exit Codes. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A060. Files
- Task: write review rule and connect the observation explicitly to
Files. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A061. Pipelines
- Task: validate input and connect the observation explicitly to
Pipelines. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A062. Testing
- Task: explain exit code and connect the observation explicitly to
Testing. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A063. Security
- Task: check quoting and connect the observation explicitly to
Security. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A064. Operations
- Task: test error path and connect the observation explicitly to
Operations. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A065. Interpreter
- Task: review log output and connect the observation explicitly to
Interpreter. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A066. Quoting
- Task: trace cleanup and connect the observation explicitly to
Quoting. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A067. Exit Codes
- Task: scope portability and connect the observation explicitly to
Exit Codes. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A068. Files
- Task: mark security risk and connect the observation explicitly to
Files. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A069. Pipelines
- Task: document recovery path and connect the observation explicitly to
Pipelines. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A070. Testing
- Task: write review rule and connect the observation explicitly to
Testing. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A071. Security
- Task: validate input and connect the observation explicitly to
Security. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A072. Operations
- Task: explain exit code and connect the observation explicitly to
Operations. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A073. Interpreter
- Task: check quoting and connect the observation explicitly to
Interpreter. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A074. Quoting
- Task: test error path and connect the observation explicitly to
Quoting. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A075. Exit Codes
- Task: review log output and connect the observation explicitly to
Exit Codes. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A076. Files
- Task: trace cleanup and connect the observation explicitly to
Files. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A077. Pipelines
- Task: scope portability and connect the observation explicitly to
Pipelines. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A078. Testing
- Task: mark security risk and connect the observation explicitly to
Testing. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A079. Security
- Task: document recovery path and connect the observation explicitly to
Security. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A080. Operations
- Task: write review rule and connect the observation explicitly to
Operations. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A081. Interpreter
- Task: validate input and connect the observation explicitly to
Interpreter. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A082. Quoting
- Task: explain exit code and connect the observation explicitly to
Quoting. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A083. Exit Codes
- Task: check quoting and connect the observation explicitly to
Exit Codes. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A084. Files
- Task: test error path and connect the observation explicitly to
Files. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A085. Pipelines
- Task: review log output and connect the observation explicitly to
Pipelines. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A086. Testing
- Task: trace cleanup and connect the observation explicitly to
Testing. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A087. Security
- Task: scope portability and connect the observation explicitly to
Security. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A088. Operations
- Task: mark security risk and connect the observation explicitly to
Operations. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A089. Interpreter
- Task: document recovery path and connect the observation explicitly to
Interpreter. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A090. Quoting
- Task: write review rule and connect the observation explicitly to
Quoting. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A091. Exit Codes
- Task: validate input and connect the observation explicitly to
Exit Codes. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A092. Files
- Task: explain exit code and connect the observation explicitly to
Files. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A093. Pipelines
- Task: check quoting and connect the observation explicitly to
Pipelines. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A094. Testing
- Task: test error path and connect the observation explicitly to
Testing. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A095. Security
- Task: review log output and connect the observation explicitly to
Security. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A096. Operations
- Task: trace cleanup and connect the observation explicitly to
Operations. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A097. Interpreter
- Task: scope portability and connect the observation explicitly to
Interpreter. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A098. Quoting
- Task: mark security risk and connect the observation explicitly to
Quoting. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A099. Exit Codes
- Task: document recovery path and connect the observation explicitly to
Exit Codes. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A100. Files
- Task: write review rule and connect the observation explicitly to
Files. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A101. Pipelines
- Task: validate input and connect the observation explicitly to
Pipelines. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A102. Testing
- Task: explain exit code and connect the observation explicitly to
Testing. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A103. Security
- Task: check quoting and connect the observation explicitly to
Security. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A104. Operations
- Task: test error path and connect the observation explicitly to
Operations. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A105. Interpreter
- Task: review log output and connect the observation explicitly to
Interpreter. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A106. Quoting
- Task: trace cleanup and connect the observation explicitly to
Quoting. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A107. Exit Codes
- Task: scope portability and connect the observation explicitly to
Exit Codes. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A108. Files
- Task: mark security risk and connect the observation explicitly to
Files. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A109. Pipelines
- Task: document recovery path and connect the observation explicitly to
Pipelines. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A110. Testing
- Task: write review rule and connect the observation explicitly to
Testing. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A111. Security
- Task: validate input and connect the observation explicitly to
Security. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.
A112. Operations
- Task: explain exit code and connect the observation explicitly to
Operations. - Evidence: Record the checked command, expected output, actual output and exit code.
- Operations question: What happens with empty input, missing files, missing tools and repeated execution?
- Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
- Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.