vetsh

vetsh

AI-powered security review for shell scripts. A safer alternative to curl | bash.

vetsh https://example.com/install.sh

vetsh fetches the script, runs static analysis and an LLM security review, then shows you the results before you decide whether to execute it.

How it works

1. Fetch the script from a URL (or stdin)
2. Sanitize the script at the AST level to prevent prompt injection
3. Static analysis detects dangerous patterns deterministically (fetch-and-execute, exfiltration, persistence, privilege escalation, obfuscation)
4. LLM review analyzes the script's structural behavior and produces a risk assessment
5. You decide whether to execute

Prompt injection resistance

The core problem with using an LLM to review untrusted code: the code itself could contain instructions that manipulate the reviewer. vetsh solves this with AST-level sanitization before the script ever reaches the LLM:

• Comments are stripped — no hidden instructions
• Variable and function names are replaced with generic identifiers (VAR_1, FUNC_2) — no semantic manipulation through naming
• String contents are replaced with length-annotated placeholders (<S1:42 chars>) — no injection through string literals
• URLs are extracted and listed separately for inspection

The LLM sees only the script's structure — what commands run, what files are read/written, how data flows — without any author-controlled text that could influence its judgment.

When a string's content matters for security (e.g., what's being written to /etc/resolv.conf, or what's being eval'd), the LLM can selectively request it via a reveal_string tool call. This keeps the attack surface minimal: the model inspects only what's relevant, one string at a time.

Limitations

• Bash scripts only. The shell parser (mvdan.cc/sh/v3) handles POSIX sh and Bash. Other languages (Python, Perl, etc.) won't parse correctly.
• Not a sandbox. vetsh reviews the script but executes it directly if you approve. It doesn't isolate execution.
• LLM judgment is imperfect. The static analysis is deterministic and reliable, but the LLM review is advisory. A sophisticated attack could potentially evade review.
• 1 MB script size limit.

Install

go install github.com/p337r/vetsh@latest

Then run vetsh --init to configure your LLM provider, or just run vetsh <url> and it will walk you through setup.

Providers

vetsh supports multiple LLM backends:

Config is stored in ~/.config/vetsh/config.toml.

Usage

# Review a script interactively
vetsh https://example.com/install.sh

# Review only, don't prompt to execute
vetsh --dry-run https://example.com/install.sh

# Show the raw script before review
vetsh --show-script https://example.com/install.sh

# Structured JSON output (for automation)
vetsh --json https://example.com/install.sh

# Pipe-safe mode: passes script through if safe, blocks if not
curl -s https://example.com/install.sh | vetsh --shield - | bash

# Override provider for one run
vetsh --provider anthropic https://example.com/install.sh

# Re-run config setup
vetsh --init

Shield mode

Shield mode (--shield) is designed for CI or pipe workflows. It reads the script from stdin, runs the full analysis, and:

• Passes the script through to stdout if the review is LOW/SAFE
• Blocks with an error if static analysis finds CRITICAL issues or the LLM rates it HIGH/CRITICAL

curl -s https://example.com/install.sh | vetsh --shield - | bash

License

MIT