diff --git a/libexec/portzap/commands/clone b/libexec/portzap/commands/clone
index 113e9be..31ab4f6 100644
--- a/libexec/portzap/commands/clone
+++ b/libexec/portzap/commands/clone
@@ -10,6 +10,6 @@ clone() {
         echo "Run 'portzap pull' instead."
         exit 1
     fi
-    umask $clone_mask
-    git clone $ports_url $portzap_dir
+    umask "$clone_mask"
+    git clone "$ports_url" "$portzap_dir"
 }
diff --git a/libexec/portzap/commands/install b/libexec/portzap/commands/install
index 7eb1c90..26e77a6 100644
--- a/libexec/portzap/commands/install
+++ b/libexec/portzap/commands/install
@@ -3,7 +3,7 @@
 __changed_files() {
     rev=$1
     echo $(
-      git diff --name-only --diff-filter=RAM $rev..HEAD | \
+      git diff --name-only --diff-filter=RAM "$rev"..HEAD | \
       cut -d / -f1 -f2 | \
       uniq
     )
@@ -11,7 +11,7 @@ __changed_files() {
 
 __removed_files() {
     rev=$1
-    echo $(git diff --name-only --diff-filter=D $rev..HEAD)
+    echo $(git diff --name-only --diff-filter=D "$rev"..HEAD)
 }
 
 install() {
@@ -19,35 +19,34 @@ install() {
     portzap_dir=$2
     libexec_dir=$3
     portzap_file=$4
-
-    cd $portzap_dir
+    cd "$portzap_dir" || exit 1
     if [ -e "$portzap_file" ]; then
-        rev=$(cat $portzap_file)
+        rev=$(cat "$portzap_file")
         ch_files=$(eval __changed_files "$rev")
         rm_files=$(eval __removed_files "$rev")
         for file in $rm_files; do
-            echo RM $ports_dir/$file
-            rm $ports_dir/$file
+            echo RM "$ports_dir/$file"
+            rm "$ports_dir/$file"
         done
         for file in $ch_files; do
             if [ -f "$file" ]; then
-                echo $file
-                $libexec_dir/install-file $ports_dir $file
+                echo "$file"
+                "$libexec_dir/install-file" "$ports_dir" "$file"
             else
                 dir=$file
-                $libexec_dir/install-directory $ports_dir $libexec_dir $dir
+                "$libexec_dir/install-directory" "$ports_dir" "$libexec_dir" "$dir"
             fi
         done
     else
         find -s . -maxdepth 1 -type f \
             \( -not -name ".gitignore" \) \
             \( -not -name ".arcconfig" \) \
-            -exec $libexec_dir/install-file $ports_dir {} +
+            -exec "$libexec_dir/install-file" "$ports_dir" {} +
         find -s . -maxdepth 1 -type d \
             \( -not -name "." \) \
             \( -not -name ".git" \) \
             \( -not -name ".hooks" \) \
-            -exec $libexec_dir/install-directory $ports_dir $libexec_dir {} +
+            -exec "$libexec_dir/install-directory" "$ports_dir" "$libexec_dir" {} +
     fi
-    echo $(git rev-parse HEAD) > $portzap_file
+    git rev-parse HEAD > "$portzap_file"
 }
diff --git a/libexec/portzap/commands/pull b/libexec/portzap/commands/pull
index 93523c3..34bdcfa 100644
--- a/libexec/portzap/commands/pull
+++ b/libexec/portzap/commands/pull
@@ -3,10 +3,9 @@
 pull() {
     portzap_dir=$1
     pull_mask=$2
-
     if [ -e "$portzap_dir/.git" ]; then
-        umask $pull_mask
-        cd $portzap_dir
+        umask "$pull_mask"
+        cd "$portzap_dir" || exit 1
         git pull --rebase origin hardenedbsd/main
     else
         echo "Run 'portzap clone' first."
diff --git a/libexec/portzap/functions/requirements.sh b/libexec/portzap/functions/requirements.sh
index a634edd..91d3392 100644
--- a/libexec/portzap/functions/requirements.sh
+++ b/libexec/portzap/functions/requirements.sh
@@ -1,9 +1,10 @@
+#!/bin/sh
+
 require_deps() {
     deps=$1
     for dep in $deps; do
-        which -s $dep
-        if [ $? -ne 0 ]; then
-            echo $dep is required, but not found
+        if ! which -s "$dep"; then
+            echo "$dep" is required, but not found
             exit 1
         fi
     done
@@ -11,7 +12,7 @@ require_deps() {
 
 require_group() {
     group=$1
-    cmd=$(id -Gn | tr ' ' '\n' | grep ^${group}$)
+    cmd=$(id -Gn | tr ' ' '\n' | grep "^${group}$")
     if [ "$cmd" != "$group" ]; then
         echo "You must be a member of the '$group' group to run this command."
         exit 1
@@ -19,7 +20,7 @@ require_group() {
 }
 
 require_root() {
-    if [ $(id -u) -ne 0 ]; then
+    if [ "$(id -u)" != "0" ]; then
         echo "The install command must be run as root."
         exit 1
     fi
diff --git a/libexec/portzap/install-directory b/libexec/portzap/install-directory
index c66d6dc..0c40769 100755
--- a/libexec/portzap/install-directory
+++ b/libexec/portzap/install-directory
@@ -4,20 +4,21 @@ libexec_dir=$2
 group=_portzap
 mode=u=rwx,g=rwx,o=
 for i in $(seq 3 $#); do
-    relative_portzap_dir=$(eval echo -n \${$i})
+    relative_portzap_dir=$(eval echo -n "\${$i}")
+    realpath=$(realpath "$ports_dir/$relative_portzap_dir")
     # Install directory
     install -d -g $group -m $mode \
-            $relative_portzap_dir \
-            $ports_dir/$relative_portzap_dir
-    echo $(realpath $ports_dir/$relative_portzap_dir)
+            "$relative_portzap_dir" \
+            "$ports_dir/$relative_portzap_dir"
+    echo "$realpath"
 
     # Install files
-    find $relative_portzap_dir -maxdepth 1 -type f \
+    find "$relative_portzap_dir" -maxdepth 1 -type f \
         \( -not -name ".gitignore" \) \
         \( -not -name ".arcconfig" \) \
-        -exec $libexec_dir/install-file $ports_dir/$relative_portzap_dir {} +
+        -exec "$libexec_dir/install-file" "$ports_dir/$relative_portzap_dir" {} +
 
     # Install subdirs (recursive)
-    find -s $relative_portzap_dir -depth 1 -type d \
-         -exec $libexec_dir/install-directory $ports_dir $libexec_dir {} \;
+    find -s "$relative_portzap_dir" -depth 1 -type d \
+         -exec "$libexec_dir/install-directory" "$ports_dir" "$libexec_dir" {} \;
 done
diff --git a/libexec/portzap/install-file b/libexec/portzap/install-file
index 0b4d29b..a1b6e0a 100755
--- a/libexec/portzap/install-file
+++ b/libexec/portzap/install-file
@@ -4,6 +4,7 @@ group=_portzap
 mode=u=rw,g=rw,o=
 files=""
 for i in $(seq 2 $#); do
-    files="${files} $(eval echo -n \${$i})"
+    file=$(eval echo -n "\$$i")
+    files="$files $file"
 done
-install -g $group -m $mode $files $dest
+install -g $group -m $mode "$files" "$dest"