I'm writing commands for the Raycast launcher.

It took me a while to figure out how to robustly pass arguments to AppleScript/osascript in Raycast script commands. This is how:

#!/bin/bash

# @raycast.schemaVersion 1
# @raycast.title Say something
# @raycast.mode silent
# @raycast.argument1 { "type": "text", "placeholder": "something to say" }

osascript - "$1" <<END
  on run argv
    set arg to (item 1 of argv)
    say arg
  end
END

We're passing the shell argument $1 into osascript, where it in turn becomes the first argv argument.

If we had just interpolated $1 directly into the AppleScript like say "$1", we would effectively run an injection attack on ourselves. It would work for simple input like "hello" but would break on input like 'hello "world"'.

UPDATE:

I've since realised you can write AppleScript directly:

#!/usr/bin/env osascript

# …

on run argv
  set arg to (item 1 of argv)
  say arg
end

I'll let the post stand – it is still useful for doing bits of AppleScript inside a shell script.