Skip to content

Add PowerShell setup-pattern scanning #1

Description

@Pavithran-R-A

Problem

SetupSentry currently only detects dangerous patterns in bash/sh shell commands. Windows-based projects and coding agents using PowerShell may contain dangerous setup patterns that go undetected.

Proposed Scope

Add rule(s) that detect dangerous PowerShell setup patterns, such as:

  • Invoke-WebRequest piped to Invoke-Expression
  • DownloadString piped to execution
  • IEX / Invoke-Expression with remote content
  • Start-Process with untrusted URLs
  • Certificate bypass ([Net.ServicePointManager]::SecurityProtocol)

Files/Components

  • New rule file(s) in src/rules/
  • Tests in tests/rules.test.ts
  • Update src/discovery.ts to discover .ps1 files if warranted
  • Update README with PowerShell coverage notes

Acceptance Criteria

  • At least one new rule detecting PowerShell-specific dangerous patterns
  • Positive and negative test cases
  • Rule registered in src/rules/index.ts
  • README updated to reflect PowerShell coverage (or scope limitation explained)
  • All existing tests still pass

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requestgood first issueGood for newcomershelp wantedExtra attention is neededruleConcerns a specific scanner rule (SS001-SS010)

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions