Sample: Shell — see SquidGate detect findings

[DotNetRussell]

SquidGate language sample — Shell

This PR intentionally introduces insecure patterns so you can see SquidGate work on Shell:

• Hardcoded secret / credential
• Injection and/or dangerous API usage

File

examples/shell/demo.sh

What to look for

1. Check run named SquidGate
2. Line annotations on the sample file
3. PR comment summarizing findings
4. Check failure when severity ≥ block_on (default high)

Demo only. Do not merge these patterns into production apps.

All language samples · Setup SquidGate on your repo

[github-actions]

🛡️ Security Scan Results

The new demo script contains a hardcoded secret and multiple injection vulnerabilities (SQL and command) that represent clear high/critical security risks.

⛔ 3 finding(s) block merge.

HIGH — Hardcoded Credential

File: examples/shell/demo.sh:3 | Confidence: high

A secret API key is hardcoded directly in the source code. This exposes the credential if the file is committed to version control, shared, or accessed by unauthorized users.

CWE: CWE-798 | OWASP: A07:2021

Recommendation: Remove the hardcoded key. Load secrets from environment variables (e.g., ${API_KEY}) or a secure secrets manager at runtime.

---

HIGH — SQL Injection

File: examples/shell/demo.sh:7 | Confidence: high

Unsanitized user input ($1) is directly interpolated into a SQL query string passed to the mysql client. An attacker can inject SQL via the argument to alter the query or extract data.

CWE: CWE-89 | OWASP: A03:2021

Recommendation: Use parameterized queries or prepared statements. Avoid constructing SQL commands from untrusted input; escape or validate $1 before use.

---

CRITICAL — Command Injection via eval

File: examples/shell/demo.sh:12 | Confidence: high

The eval builtin executes a string containing unsanitized user input ($1). This allows arbitrary command execution, including shell metacharacters for full RCE.

CWE: CWE-78 | OWASP: A03:2021

Recommendation: Remove eval. Use direct command execution with proper argument handling (e.g., echo "$1" without eval) or validate/sanitize input strictly.

---