diff --git a/tools/packaging/static-build/nydus/build.sh b/tools/packaging/static-build/nydus/build.sh
index d66c8bb177..1f5e4d5415 100755
--- a/tools/packaging/static-build/nydus/build.sh
+++ b/tools/packaging/static-build/nydus/build.sh
@@ -10,6 +10,7 @@ set -o pipefail
 
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
+# shellcheck source=/dev/null
 source "${script_dir}/../../scripts/lib.sh"
 
 arch="$(uname -m)"
@@ -18,24 +19,24 @@ nydus_url="${nydus_url:-}"
 nydus_version="${nydus_version:-}"
 
 info "Get nydus information from runtime versions.yaml"
-[ -n "$nydus_url" ] || nydus_url=$(get_from_kata_deps ".externals.nydus.url")
-[ -n "$nydus_url" ] || die "failed to get nydus url"
-[ -n "$nydus_version" ] || nydus_version=$(get_from_kata_deps ".externals.nydus.version")
-[ -n "$nydus_version" ] || die "failed to get nydus version"
+[[ -n "${nydus_url}" ]] || nydus_url=$(get_from_kata_deps ".externals.nydus.url")
+[[ -n "${nydus_url}" ]] || die "failed to get nydus url"
+[[ -n "${nydus_version}" ]] || nydus_version=$(get_from_kata_deps ".externals.nydus.version")
+[[ -n "${nydus_version}" ]] || die "failed to get nydus version"
 
 nydus_tarball_url="${nydus_url}/releases/download"
 
-file_name="nydus-static-${nydus_version}-linux-$(arch_to_golang $arch).tgz"
+file_name="nydus-static-${nydus_version}-linux-$(arch_to_golang "${arch}").tgz"
 download_url="${nydus_tarball_url}/${nydus_version}/${file_name}"
 
 info "Download nydus version: ${nydus_version} from ${download_url}"
-curl -o ${file_name} -L $download_url
+curl -o "${file_name}" -L "${download_url}"
 
 sha256sum="${file_name}.sha256sum"
 sha256sum_url="${nydus_tarball_url}/${nydus_version}/${sha256sum}"
 
 info "Download nydus ${sha256sum} from ${sha256sum_url}"
-curl -o ${sha256sum} -L $sha256sum_url
+curl -o "${sha256sum}" -L "${sha256sum_url}"
 
-sha256sum -c ${sha256sum}
-tar zxvf ${file_name}
+sha256sum -c "${sha256sum}"
+tar zxvf "${file_name}"