--- a/taskcluster/docker/funsize-balrog-submitter/runme.sh
+++ b/taskcluster/docker/funsize-balrog-submitter/runme.sh
@@ -1,25 +1,27 @@
 #!/bin/bash
 
 set -xe
 
-test $PARENT_TASK_ARTIFACTS_URL_PREFIX
-test $BALROG_API_ROOT
-test $SHA1_SIGNING_CERT
-test $SHA384_SIGNING_CERT
+test "$PARENT_TASK_ARTIFACTS_URL_PREFIX"
+test "$BALROG_API_ROOT"
+test "$SHA1_SIGNING_CERT"
+test "$SHA384_SIGNING_CERT"
 
 
 ARTIFACTS_DIR="/home/worker/artifacts"
 mkdir -p "$ARTIFACTS_DIR"
 
 curl --location --retry 10 --retry-delay 10 -o "$ARTIFACTS_DIR/manifest.json" \
     "$PARENT_TASK_ARTIFACTS_URL_PREFIX/manifest.json"
 
 cat "$ARTIFACTS_DIR/manifest.json"
+# EXTRA_BALROG_SUBMITTER_PARAMS is optional
+# shellcheck disable=SC2086
 python /home/worker/bin/funsize-balrog-submitter.py \
     --artifacts-url-prefix "$PARENT_TASK_ARTIFACTS_URL_PREFIX" \
     --manifest "$ARTIFACTS_DIR/manifest.json" \
     -a "$BALROG_API_ROOT" \
     --sha1-signing-cert "/home/worker/keys/${SHA1_SIGNING_CERT}.pubkey" \
     --sha384-signing-cert "/home/worker/keys/${SHA384_SIGNING_CERT}.pubkey" \
     --verbose \
     $EXTRA_BALROG_SUBMITTER_PARAMS

--- a/taskcluster/docker/funsize-balrog-submitter/submit_complete.sh
+++ b/taskcluster/docker/funsize-balrog-submitter/submit_complete.sh
@@ -1,23 +1,23 @@
 #!/bin/bash
 
 set -xe
 
-test $PARENT_TASK_ARTIFACTS_URL_PREFIX
-test $BALROG_API_ROOT
+test "$PARENT_TASK_ARTIFACTS_URL_PREFIX"
+test "$BALROG_API_ROOT"
 # BALROG_BLOB_SUFFIX is used by the script implicitly to avoid possible CLI
 # issues with suffixes starting with "-"
-test $BALROG_BLOB_SUFFIX
+test "$BALROG_BLOB_SUFFIX"
 
 
 ARTIFACTS_DIR="/home/worker/artifacts"
 mkdir -p "$ARTIFACTS_DIR"
 
 curl --location --retry 10 --retry-delay 10 -o "$ARTIFACTS_DIR/manifest.json" \
     "$PARENT_TASK_ARTIFACTS_URL_PREFIX/manifest.json"
 
 cat "$ARTIFACTS_DIR/manifest.json"
 python /home/worker/bin/funsize-balrog-submitter-complete.py  \
     --manifest "$ARTIFACTS_DIR/manifest.json" \
     -a "$BALROG_API_ROOT" \
     --verbose \
-    $EXTRA_BALROG_SUBMITTER_PARAMS
+    "$EXTRA_BALROG_SUBMITTER_PARAMS"

--- a/taskcluster/docker/funsize-update-generator/recompress.sh
+++ b/taskcluster/docker/funsize-update-generator/recompress.sh
@@ -1,24 +1,24 @@
 #!/bin/sh
 
 set -xe
 
-test $TASK_ID
-test $SHA1_SIGNING_CERT
-test $SHA384_SIGNING_CERT
+test "$TASK_ID"
+test "$SHA1_SIGNING_CERT"
+test "$SHA384_SIGNING_CERT"
 
 ARTIFACTS_DIR="/home/worker/artifacts"
 mkdir -p "$ARTIFACTS_DIR"
 
 curl --location --retry 10 --retry-delay 10 -o /home/worker/task.json \
     "https://queue.taskcluster.net/v1/task/$TASK_ID"
 
-if [ ! -z $OUTPUT_FILENAME ]; then
+if [ ! -z "$OUTPUT_FILENAME" ]; then
     EXTRA_PARAMS="--output-filename $OUTPUT_FILENAME $EXTRA_PARAMS"
 fi
 
 /home/worker/bin/recompress.py \
     --artifacts-dir "$ARTIFACTS_DIR" \
     --task-definition /home/worker/task.json \
     --sha1-signing-cert "/home/worker/keys/${SHA1_SIGNING_CERT}.pubkey" \
     --sha384-signing-cert "/home/worker/keys/${SHA384_SIGNING_CERT}.pubkey" \
-    $EXTRA_PARAMS
+    "$EXTRA_PARAMS"

--- a/taskcluster/docker/funsize-update-generator/runme.sh
+++ b/taskcluster/docker/funsize-update-generator/runme.sh
@@ -46,14 +46,16 @@ else
   # enable locale cache
   export MBSDIFF_HOOK="/home/worker/bin/mbsdiff_hook.sh -c /tmp/fs-cache"
 fi
 
 if [ ! -z "$FILENAME_TEMPLATE" ]; then
     EXTRA_PARAMS="--filename-template $FILENAME_TEMPLATE $EXTRA_PARAMS"
 fi
 
+# EXTRA_PARAMS is optional
+# shellcheck disable=SC2086
 /home/worker/bin/funsize.py \
     --artifacts-dir "$ARTIFACTS_DIR" \
     --task-definition /home/worker/task.json \
     --sha1-signing-cert "/home/worker/keys/${SHA1_SIGNING_CERT}.pubkey" \
     --sha384-signing-cert "/home/worker/keys/${SHA384_SIGNING_CERT}.pubkey" \
     $EXTRA_PARAMS