frost, static audit

Read the script before you trust it.

A frost script is parsed, not assembled from strings, so what it can do is visible before anything runs. These three reports were produced by the analyzer itself.

In bash, rm -rf "$DIR" is just text until the moment it executes. There is nothing to inspect. Here the program and each argument are separate nodes in a tree.

Before you run it, you can read exactly what it is allowed to do. Bash cannot do this.