Fix shellcode issues

Would be nice to avoid the shellcheck ignores overall, though I
don't want to break backwards compatibility with existing
configurations, so be as conservative as possible by ignoring
known incompatibilities (see esp. disable=SC2086).