diff --git a/scripts/boot-qemu.sh b/scripts/boot-qemu.sh
index f17ed14..c07112e 100755
--- a/scripts/boot-qemu.sh
+++ b/scripts/boot-qemu.sh
@@ -39,7 +39,7 @@
 echo "QEMU_ARCH = $QEMU_ARCH"
 if [[ -z $QEMU_ARCH ]]; then
     echo "Did not pass in required QEMU arch parameter"
-    exit -1
+    exit 1
 fi
 
 BASE_DIR=${2:-$HOME}
@@ -47,7 +47,7 @@
 echo "BASE_DIR = $BASE_DIR"
 if [[ ! -d $BASE_DIR ]]; then
     echo "No input directory and HOME not set!"
-    exit -1
+    exit 1
 fi
 
 # Set the location of the qemu binary relative to BASE_DIR
@@ -57,18 +57,19 @@
 MACHINE=${MACHINE:-${DEFAULT_MACHINE}}
 
 # Enter the base directory
-cd ${BASE_DIR}
+cd "${BASE_DIR}"
 
 # Find the correct drive file, and save its name.  OpenBMC has 3 different
 # image formats.  The UBI based one, the standard static.mtd one, and the
 # default QEMU basic image (rootfs.ext4).
 
 DEFAULT_IMAGE_LOC="./tmp/deploy/images/"
-if [ -f ${DEFAULT_IMAGE_LOC}/${MACHINE}/obmc-phosphor-image-${MACHINE}.ubi.mtd ]; then
-    DRIVE=obmc-phosphor-image-${MACHINE}.ubi.mtd
-elif [ -f ${DEFAULT_IMAGE_LOC}/${MACHINE}/obmc-phosphor-image-${MACHINE}.static.mtd ]; then
-    DRIVE=obmc-phosphor-image-${MACHINE}.static.mtd
+if [ -f ${DEFAULT_IMAGE_LOC}/"${MACHINE}"/obmc-phosphor-image-"${MACHINE}".ubi.mtd ]; then
+    DRIVE="obmc-phosphor-image-${MACHINE}.ubi.mtd"
+elif [ -f ${DEFAULT_IMAGE_LOC}/"${MACHINE}"/obmc-phosphor-image-"${MACHINE}".static.mtd ]; then
+    DRIVE="obmc-phosphor-image-${MACHINE}.static.mtd"
 else
+    # shellcheck disable=SC2010
     DRIVE=$(ls ${DEFAULT_IMAGE_LOC}/qemuarm | grep rootfs.ext4)
 fi
 
@@ -79,10 +80,10 @@
 
 # The drive file is stored in different locations depending on if we are
 # using the default or real platforms.
-if [ ${MACHINE} = ${DEFAULT_MACHINE} ]; then
-    cp ${DEFAULT_IMAGE_LOC}/qemuarm/${DRIVE} ${TMP_DRIVE_PATH}
+if [ "${MACHINE}" = "${DEFAULT_MACHINE}" ]; then
+    cp ${DEFAULT_IMAGE_LOC}/qemuarm/"${DRIVE}" "${TMP_DRIVE_PATH}"
 else
-    cp ${DEFAULT_IMAGE_LOC}/${MACHINE}/${DRIVE} ${TMP_DRIVE_PATH}
+    cp ${DEFAULT_IMAGE_LOC}/"${MACHINE}"/"${DRIVE}" "${TMP_DRIVE_PATH}"
 fi
 
 # Obtain IP from /etc/hosts if IP is not valid set to localhost
@@ -97,7 +98,7 @@
 
 # Most system only have one NIC so set this as default
 NIC="-net nic,model=ftgmac100,netdev=netdev1 -netdev user,id=netdev1,$NET_FORWARDING"
-if [ ${MACHINE} = "tacoma" ]; then
+if [ "${MACHINE}" = "tacoma" ]; then
     # Tacoma requires us to specify up to four NICs, with the third one being
     # the active device.
     NIC="-net nic,model=ftgmac100,netdev=netdev1 -netdev user,id=netdev1 "
@@ -108,14 +109,14 @@
 
 # The syntax to start old qemu / default version requires different syntax
 # then new qemu with the real platforms
-if [ ${MACHINE} = ${DEFAULT_MACHINE} ]; then
+if [ "${MACHINE}" = "${DEFAULT_MACHINE}" ]; then
     # Launch default QEMU using the qemu-system-arm
     ${QEMU_BIN} \
         -device virtio-net,netdev=mynet \
         -netdev user,id=mynet,hostfwd=tcp:${IP}:22-:22,hostfwd=tcp:${IP}:443-:443,hostfwd=tcp:${IP}:80-:80,hostfwd=tcp:${IP}:2200-:2200,hostfwd=udp:${IP}:623-:623,hostfwd=udp:${IP}:664-:664 \
         -machine versatilepb \
         -m 256 \
-        -drive file=${TMP_DRIVE_PATH},if=virtio,format=raw \
+        -drive file="${TMP_DRIVE_PATH}",if=virtio,format=raw \
         -show-cursor \
         -usb \
         -usbdevice tablet \
@@ -127,9 +128,10 @@
         -append 'root=/dev/vda rw highres=off  console=ttyS0 mem=256M ip=dhcp console=ttyAMA0,115200 console=tty'\
         -dtb ${DEFAULT_IMAGE_LOC}/qemuarm/zImage-versatile-pb.dtb
 else
+    # shellcheck disable=SC2086 # NIC is intentionally word-split.
     ${QEMU_BIN} \
-        -machine ${MACHINE}-bmc \
+        -machine "${MACHINE}"-bmc \
         -nographic \
-        -drive file=${TMP_DRIVE_PATH},format=raw,if=mtd \
+        -drive file="${TMP_DRIVE_PATH}",format=raw,if=mtd \
         ${NIC}
 fi
diff --git a/scripts/build-qemu-robot-docker.sh b/scripts/build-qemu-robot-docker.sh
index 4a55894..d8e4a8f 100755
--- a/scripts/build-qemu-robot-docker.sh
+++ b/scripts/build-qemu-robot-docker.sh
@@ -25,7 +25,7 @@
 PIP_MIRROR=${PIP_MIRROR:-""}
 
 # Determine our architecture, ppc64le or the other one
-if [ $(uname -m) == "ppc64le" ]; then
+if [ "$(uname -m)" == "ppc64le" ]; then
     DOCKER_BASE="ppc64le/"
 else
     DOCKER_BASE=""
@@ -42,7 +42,7 @@
 
 PIP_MIRROR_CMD=""
 if [[ -n "${PIP_MIRROR}" ]]; then
-    PIP_HOSTNAME=$(echo ${PIP_MIRROR} | awk -F[/:] '{print $4}')
+    PIP_HOSTNAME=$(echo "${PIP_MIRROR}" | awk -F[/:] '{print $4}')
     PIP_MIRROR_CMD="RUN mkdir -p \${HOME}/.pip && \
         echo \"[global]\" > \${HOME}/.pip/pip.conf && \
         echo \"index-url=${PIP_MIRROR}\" >> \${HOME}/.pip/pip.conf &&\
@@ -143,8 +143,8 @@
         && mv geckodriver /usr/local/bin \
         && chmod a+x /usr/local/bin/geckodriver
 
-RUN grep -q ${GROUPS} /etc/group || groupadd -g ${GROUPS} ${USER}
-RUN grep -q ${UID} /etc/passwd || useradd -d ${HOME} -m -u ${UID} -g ${GROUPS} \
+RUN grep -q ${GROUPS[0]} /etc/group || groupadd -g ${GROUPS[0]} ${USER}
+RUN grep -q ${UID} /etc/passwd || useradd -d ${HOME} -m -u ${UID} -g ${GROUPS[0]} \
                     ${USER}
 USER ${USER}
 RUN /bin/bash
@@ -159,4 +159,5 @@
 fi
 
 # Build above image
-docker build ${PROXY_ARGS} -t ${DOCKER_IMG_NAME} - <<< "${Dockerfile}"
+# shellcheck disable=SC2086 # PROXY_ARGS is intentionally word-split.
+docker build ${PROXY_ARGS} -t "${DOCKER_IMG_NAME}" - <<< "${Dockerfile}"
diff --git a/scripts/format-code.sh b/scripts/format-code.sh
index 1bb98a5..4da2174 100755
--- a/scripts/format-code.sh
+++ b/scripts/format-code.sh
@@ -10,7 +10,7 @@
 # Input parmameter must be full path to git repo to scan
 
 DIR=$1
-cd ${DIR}
+cd "${DIR}"
 
 set -e
 
@@ -66,7 +66,7 @@
 done
 
 searchfiles=""
-while read path; do
+while read -r path; do
   # skip ignorefiles
   if [[ $ignorefiles == *"$(basename "${path}")"* ]]; then
     continue
@@ -84,12 +84,14 @@
   if [ "$skip" = true ]; then
    continue
   fi
+  # shellcheck disable=2089
   searchfiles+="\"./${path}\" "
 
 # Get C and C++ files managed by git and skip the mako files
-done <<<$(git ls-files | grep -e '\.[ch]pp$' -e '\.[ch]$' | grep -v '\.mako\.')
+done <<<"$(git ls-files | grep -e '\.[ch]pp$' -e '\.[ch]$' | grep -v '\.mako\.')"
 
 if [[ -f ".clang-format" ]]; then
+  # shellcheck disable=SC2090 disable=SC2086
   echo ${searchfiles} | xargs "${CLANG_FORMAT}" -i
   git --no-pager diff --exit-code
 fi
diff --git a/scripts/run-robot.sh b/scripts/run-robot.sh
index f4fc34e..aad4bfd 100755
--- a/scripts/run-robot.sh
+++ b/scripts/run-robot.sh
@@ -18,6 +18,8 @@
 
 # we don't want to fail on bad rc since robot tests may fail
 
+set -e
+
 MACHINE=${MACHINE:-"qemu"}
 ROBOT_CODE_HOME=${ROBOT_CODE_HOME:-/tmp/$(whoami)/${RANDOM}/obmc-robot/}
 ROBOT_TEST_CMD=${ROBOT_TEST_CMD:-"python3 -m robot\
@@ -27,19 +29,20 @@
     --argumentfile ./test_lists/QEMU_CI ./tests"}
 
 git clone https://github.com/openbmc/openbmc-test-automation.git \
-        ${ROBOT_CODE_HOME}
+        "${ROBOT_CODE_HOME}"
 
-cd ${ROBOT_CODE_HOME}
+cd "${ROBOT_CODE_HOME}"
 
-chmod ugo+rw -R ${ROBOT_CODE_HOME}/*
+chmod ugo+rw -R "${ROBOT_CODE_HOME}"/*
 
 # Execute the CI tests
-"$($ROBOT_TEST_CMD)"
+# shellcheck disable=SC2091 # intentionally executing ROBOT_TEST_CMD.
+$($ROBOT_TEST_CMD)
 
-cp ${ROBOT_CODE_HOME}/*.xml ${HOME}/
-cp ${ROBOT_CODE_HOME}/*.html ${HOME}/
+cp "${ROBOT_CODE_HOME}"/*.xml "${HOME}/"
+cp "${ROBOT_CODE_HOME}"/*.html "${HOME}/"
 if [ -d logs ] ; then
-    cp -Rf ${ROBOT_CODE_HOME}/logs ${HOME}/ ;
+    cp -Rf "${ROBOT_CODE_HOME}"/logs "${HOME}"/ ;
 fi
 
 #rm -rf ${ROBOT_CODE_HOME}