## TL;DR

Quote the variable: `rm -rf "$BUILD_DIR"` instead of `rm -rf $BUILD_DIR`. SC2086 fires because an unquoted expansion undergoes word splitting and pathname expansion, so a value containing spaces (or glob characters) becomes multiple arguments or matches files. Quoting makes the value exactly one word, which is what you want in nearly every case.

## The error

```text
In deploy.sh line 12:
rm -rf $BUILD_DIR
     ^-- SC2086 (info): Double quote to prevent globbing and word splitting.
```

## Fix it

1. Reproduce. Run `shellcheck deploy.sh` (or the flagged script).
   Expected: one SC2086 line per unquoted expansion, with a caret pointing at it.
2. Quote the expansion. Change `$BUILD_DIR` to `"$BUILD_DIR"`, `$file` to `"$file"`, and so on.
   Expected: re-running shellcheck reports no SC2086 for those lines.
3. If the splitting is genuinely intentional (for example extra flags stored in a string), do not just leave it unquoted - use an array:
   ```sh
   flags=(--verbose --output "$out")
   mycmd "${flags[@]}"
   ```
   Expected: each flag stays a separate word, shellcheck stays quiet, and values with spaces still work.
4. As a last resort for a line where you truly want the old behavior, add a targeted directive on that line: `# shellcheck disable=SC2086`.
   Expected: shellcheck skips only that line; everything else is still checked.

## Use this when

- shellcheck reports SC2086 in CI and blocks the PR
- A review script breaks on paths with spaces
- You see "Double quote to prevent globbing and word splitting" in a lint log

## Not for this skill when

- The unquoted variable is a symptom of a deeper logic bug - fix the logic too, not just the quoting
- The script intentionally relies on glob expansion and an array does not fit - use the disable directive and move on
- The failure is a shellcheck parse error on the script itself (syntax problem, not a quoting warning)

## Variant phrasings

- shellcheck double quote to prevent globbing
- SC2086 how to fix
- shellcheck warning unquoted variable
- shellcheck info word splitting

## Why it happens

The shell expands `$var` in two extra passes before running the command: word splitting (on spaces, tabs, newlines) and pathname expansion (globbing). Quoting with double quotes disables both passes while still expanding the variable. Almost every SC2086 is a latent bug waiting for a filename with a space.

## Edge cases

- `"$@"` preserves each argument separately; `$*` joins them - use `"$@"` when forwarding arguments
- Quoting inside `[[ ... ]]` tests is harmless but unnecessary - the test construct does not split
- Arrays are the correct fix for multi-word flags; a disable comment is the correct fix for a deliberate glob like `for f in *.log`
- The same rule applies inside Dockerfile RUN lines that shellcheck (via hadolint) inspects
- `set -f` disables globbing globally but hides bugs instead of fixing them - prefer quoting

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_wUZ38v7dvSbFGEA8pSO_hA