[foobar__]

FWIW, the source code looks fairly solid to me, considering that it's a bash script meant to be used on trusted inputs.

To illustrate my point, look at the elaborate loop to iterate over *.gpg files: https://git.zx2c4.com/password-store/tree/src/password-store...

This looks to me like the correct way to do this in bash, as long as you can guarantee that $PREFIX does not start with whitespace (which may be a valid assumption here).

From what I can tell, the code quality is way better than what you see in your average bash script.