We propose SHILL, a secure shell scripting language.
SHILL scripts enable compositional reasoning about security
through contracts that limit the effects of script
execution, including the effects of programs invoked by
the script. SHILL contracts are declarative security policies
that act as documentation for consumers of SHILL
scripts, and are enforced through a combination of language
design and sandboxing.