Not all shells set SHELL, and even in bash, SHELL isn't readonly. If I run for instance 'tcsh' from bash, SHELL will still say "/bin/bash" because tcsh doesn't set SHELL.

But I don't understand why it matters what shell the user is running when calling your script. If the script starts with

   #!/bin/bash
[download]

then the script will be run by bash, unless explicitly run by another shell. In that case, don't do it.

Note also that you can get a users login shell by just checking the result of getpwnam().