Bash LSP server can use shellcheck and shfmt but you have to install those manually.

Funny thing is that LSP was actually created for VSCode. That’s the now standard protocol to decouple language specific things (completion, formatting, linting…) from the editor so you don’t have to use an editor for each language. You can now use any editor that supports LSP, either directly or through a plugin, and turn it into a fully fledged IDE by installing the LSP servers for the language you need. I guess some VSCode plugins use LSP under the hood and just embed the server.

Is pluging a LSP server that hard on vscode/intellij? Because it’s automatic with a lot of LSP clients, open a .sh file, get asked if you want to install the corresponding LSP server, answer yes and that’s it. Some LSP clients don’t do automatic server install but you just have to install the server with your packet manager. At least that’s how it is with vim / emacs.

You don’t need a plugin, just use the bash LSP server with any editor that support LSP servers. It supports explainshell, shellcheck and shfmt.

This, of course, can only tell you if an apk is malicious, it cannot tell you if it is not malicious.