Skip to content

Add PowerShell setup-pattern scanning #1

Description

@Pavithran-R-A

Problem

SetupSentry currently only detects dangerous patterns in bash/sh shell commands. Windows-based projects and coding agents using PowerShell may contain dangerous setup patterns that go undetected.

Proposed Scope

Add rule(s) that detect dangerous PowerShell setup patterns, such as:

  • Invoke-WebRequest piped to Invoke-Expression
  • DownloadString piped to execution
  • IEX / Invoke-Expression with remote content
  • Start-Process with untrusted URLs
  • Certificate bypass ([Net.ServicePointManager]::SecurityProtocol)

Files/Components

  • New rule file(s) in src/rules/
  • Tests in tests/rules.test.ts
  • Update src/discovery.ts to discover .ps1 files if warranted
  • Update README with PowerShell coverage notes

Acceptance Criteria

  • At least one new rule detecting PowerShell-specific dangerous patterns
  • Positive and negative test cases
  • Rule registered in src/rules/index.ts
  • README updated to reflect PowerShell coverage (or scope limitation explained)
  • All existing tests still pass

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requestgood first issueGood for newcomershelp wantedExtra attention is neededruleConcerns a specific scanner rule (SS001-SS010)

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions