{
  "action": "scan",
  "script": "Bash script containing recursive forced deletion targeting root and curl output piped to shell"
}

{
  "action": "scan",
  "ok": true,
  "result": {
    "finding_count": 2,
    "findings": [
      {
        "line": 2,
        "message": "Detected critical risk: recursive forced deletion targeting root \u2014 will destroy the filesystem",
        "pattern": "recursive force delete root",
        "risk": "critical"
      },
      {
        "line": 3,
        "message": "Detected critical risk: remote code execution via pipe-to-shell",
        "pattern": "curl/wget pipe to shell",
        "risk": "critical"
      }
    ],
    "max_risk": "critical",
    "safe": false
  }
}

{
  "action": "validate",
  "script": "#!/bin/bash\nFILE=$1\ncp $FILE /tmp/\n"
}

{
  "action": "validate",
  "ok": true,
  "result": {
    "compliant": false,
    "issue_count": 2,
    "issues": [
      {
        "message": "Script does not use \u0027set -euo pipefail\u0027 or equivalent",
        "rule": "MISSING_STRICT_MODE"
      },
      {
        "line": 3,
        "message": "Unquoted variable: $FILE (use double quotes to prevent word-splitting)",
        "rule": "UNQUOTED_VARIABLE"
      }
    ]
  }
}

{
  "action": "safe_mode",
  "script": "Bash script using strict mode that deletes a temp directory and moves an app directory, then echoes done"
}

{
  "action": "safe_mode",
  "ok": true,
  "result": {
    "commands_neutralized": 2,
    "dry_run_script": "Dry-run version of the script with deletion and move commands replaced by echo statements, prefixed with DRY-RUN header",
    "original_lines": 6
  }
}

{
  "action": "audit",
  "script": "Bash deployment script that uses curl to fetch API data, privilege escalation to restart nginx, ssh for remote operations, and echo for status messages"
}

{
  "action": "audit",
  "ok": true,
  "result": {
    "commands": [
      {
        "name": "curl",
        "reason": "Network access \u2014 can exfiltrate data or fetch malicious content",
        "risk": "medium"
      },
      {
        "name": "privilege_escalation_cmd",
        "reason": "Privilege escalation \u2014 bypasses normal permission checks",
        "risk": "high"
      },
      {
        "name": "ssh",
        "reason": "Remote execution \u2014 executes commands on external host",
        "risk": "high"
      },
      {
        "name": "echo",
        "reason": "Safe output command",
        "risk": "low"
      }
    ],
    "risk_summary": {
      "critical": 0,
      "high": 2,
      "low": 1,
      "medium": 1
    },
    "total_commands": 4
  }
}

{
  "action": "fix",
  "script": "#!/bin/bash\nFILE=$1\nif [ $FILE == \u0027\u0027 ]; then\n  echo error\nfi\ncat $FILE\n"
}

{
  "action": "fix",
  "ok": true,
  "result": {
    "fix_count": 3,
    "fixes": [
      {
        "auto_fixable": true,
        "issue": "Missing strict mode",
        "suggestion": "Add \u0027set -euo pipefail\u0027 after shebang line"
      },
      {
        "auto_fixable": true,
        "issue": "Unquoted variable $FILE at line 2",
        "suggestion": "Change to FILE=\"$1\""
      },
      {
        "auto_fixable": true,
        "issue": "Use of [ ] for string comparison",
        "suggestion": "Use [[ ]] for safer string tests"
      }
    ],
    "patched_script": "Script with strict mode header and quoted variables applied"
  }
}

{
  "action": "scan",
  "script": "Bash script with strict mode, quoted variable from arg, file existence check, and wc line count \u2014 no dangerous patterns"
}

{
  "action": "scan",
  "ok": true,
  "result": {
    "finding_count": 0,
    "findings": [],
    "max_risk": "none",
    "safe": true
  }
}

{
  "action": "scan",
  "script": "Bash script that fetches a command string from a remote URL and passes it to eval"
}

{
  "action": "scan",
  "ok": true,
  "result": {
    "finding_count": 1,
    "findings": [
      {
        "message": "eval with variable input is critical risk \u2014 arbitrary code execution",
        "pattern": "eval with variable",
        "risk": "critical"
      }
    ],
    "max_risk": "critical",
    "safe": false
  }
}

{
  "action": "scan",
  "script": ""
}

{
  "action": "scan",
  "error": {
    "code": "MISSING_FIELD",
    "message": "Field \u0027script\u0027 must not be empty"
  },
  "ok": false
}