diff --git a/tools/commit-message-lint b/tools/commit-message-lint
index d0801d8..1c57f0f 100755
--- a/tools/commit-message-lint
+++ b/tools/commit-message-lint
@@ -10,14 +10,14 @@ $(git remote -v)
 " =~ '
 '([^[:space:]]*)[[:space:]]*(https://github\.com/|ssh://git@github\.com/|git@github\.com:)adambirds/xkcd-password-gen(\.git|/)?\ \(fetch\)'
 ' ]]; then
-    range="${BASH_REMATCH[1]}/master..HEAD"
+	range="${BASH_REMATCH[1]}/master..HEAD"
 else
-    range="upstream/master..HEAD"
+	range="upstream/master..HEAD"
 fi
 
 commits=$(git log "$range" | wc -l)
 if [ "$commits" -gt 0 ]; then
-    # Only run gitlint with non-empty commit lists, to avoid a printed
-    # warning.
-    gitlint --commits "$range"
+	# Only run gitlint with non-empty commit lists, to avoid a printed
+	# warning.
+	gitlint --commits "$range"
 fi
diff --git a/tools/commit-msg b/tools/commit-msg
index c54d85d..aad17f1 100755
--- a/tools/commit-msg
+++ b/tools/commit-msg
@@ -7,12 +7,12 @@
 
 # Do not invoke gitlint if commit message is empty
 if grep -q '^[^#]' "$1"; then
-    lint_cmd="tools/lint --only=gitlint"
-    if
-        ! eval "$lint_cmd" <"$1"
-    then
-        echo "WARNING: Your commit message does not match xkcd-pass' style guide."
-    fi
+	lint_cmd="tools/lint --only=gitlint"
+	if
+		! eval "$lint_cmd" <"$1"
+	then
+		echo "WARNING: Your commit message does not match xkcd-pass' style guide."
+	fi
 fi
 
-exit 0
\ No newline at end of file
+exit 0
diff --git a/tools/lint b/tools/lint
index a3be7fa..cdbd489 100755
--- a/tools/lint
+++ b/tools/lint
@@ -26,7 +26,7 @@ def run():
 
     # Linters will be run on these file types.
     # eg: file_types = ['py', 'html', 'css', 'js']
-    file_types = ["py"]
+    file_types = ["py", "sh", "md", "yaml"]
 
     EXCLUDED_FILES = [
         # No linters will be run on files in this list.
@@ -76,6 +76,21 @@ def run():
         description="Formats Json, YAML",
     )
 
+    linter_config.external_linter(
+        "shellcheck",
+        ["shellcheck", "-x", "-P", "SCRIPTDIR"],
+        ["sh"],
+        description="Standard shell script linter",
+    )
+    linter_config.external_linter(
+        "shfmt",
+        ["shfmt"],
+        ["sh"],
+        check_arg="-d",
+        fix_arg="-w",
+        description="Formats shell scripts",
+    )
+
     @linter_config.lint
     def check_custom_rules():
         # type: () -> int
diff --git a/tools/pre-commit b/tools/pre-commit
index 8cce9aa..9f1885d 100755
--- a/tools/pre-commit
+++ b/tools/pre-commit
@@ -7,13 +7,13 @@
 
 changed_files=()
 while read -r -d '' f; do
-    changed_files+=("$f")
+	changed_files+=("$f")
 done < <(git diff -z --cached --name-only --diff-filter=ACM)
 if [ ${#changed_files} -eq 0 ]; then
-    echo "No changed files to lint."
-    exit 0
+	echo "No changed files to lint."
+	exit 0
 fi
 
 ./tools/lint --skip=gitlint "${changed_files[@]}"
 
-exit 0
\ No newline at end of file
+exit 0
diff --git a/tools/setup-git-repo b/tools/setup-git-repo
index 4029d8d..ee63081 100755
--- a/tools/setup-git-repo
+++ b/tools/setup-git-repo
@@ -1,11 +1,11 @@
 #!/usr/bin/env bash
 
 if ! [ -d ".git/hooks/" ]; then
-    echo "Error: Could not find .git/hooks directory"
-    echo "Please re-run this script from the root of your xkcd-password-gen.git checkout"
-    exit 1
+	echo "Error: Could not find .git/hooks directory"
+	echo "Please re-run this script from the root of your xkcd-password-gen.git checkout"
+	exit 1
 fi
 
 for hook in pre-commit commit-msg; do
-    ln -snf ../../tools/"$hook" .git/hooks/
-done
\ No newline at end of file
+	ln -snf ../../tools/"$hook" .git/hooks/
+done
diff --git a/tools/setup/install-shellcheck b/tools/setup/install-shellcheck
new file mode 100755
index 0000000..8bfa7f0
--- /dev/null
+++ b/tools/setup/install-shellcheck
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -eu
+
+version=0.7.1
+tarball="shellcheck-v$version.linux.x86_64.tar.xz"
+sha256=64f17152d96d7ec261ad3086ed42d18232fcb65148b44571b564d688269d36c8
+
+check_version() {
+	out="$(shellcheck --version 2>/dev/null)" && [[ "$out" = *"
+version: $version
+"* ]]
+}
+
+if ! check_version; then
+	tmpdir="$(mktemp -d)"
+	trap 'rm -r "$tmpdir"' EXIT
+	cd "$tmpdir"
+	wget -nv "https://github.com/koalaman/shellcheck/releases/download/v$version/$tarball"
+	sha256sum -c <<<"$sha256 $tarball"
+	tar -xJf "$tarball" --no-same-owner --strip-components=1 -C /usr/local/bin "shellcheck-v$version/shellcheck"
+	check_version
+fi
diff --git a/tools/setup/install-shfmt b/tools/setup/install-shfmt
new file mode 100755
index 0000000..a2519fd
--- /dev/null
+++ b/tools/setup/install-shfmt
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -eu
+
+version=3.2.4
+binary="shfmt_v${version}_linux_amd64"
+sha256=3f5a47f8fec27fae3e06d611559a2063f5d27e4b9501171dde9959b8c60a3538
+
+check_version() {
+	out="$(shfmt --version 2>/dev/null)" && [ "$out" = "v$version" ]
+}
+
+if ! check_version; then
+	tmpdir="$(mktemp -d)"
+	trap 'rm -r "$tmpdir"' EXIT
+	cd "$tmpdir"
+	wget -nv "https://github.com/mvdan/sh/releases/download/v$version/$binary"
+	sha256sum -c <<<"$sha256 $binary"
+	chmod +x "$binary"
+	mv "$binary" /usr/local/bin/shfmt
+	check_version
+fi