Function checkDynamicCommandName

src/tools/PowerShellTool/powershellSecurity.ts:143–160

* Checks for dynamic command invocation where the command name itself is an * expression that cannot be statically resolved. * * PoCs: * & ${function:Invoke-Expression} 'payload' — VariableExpressionAst * & ('iex','x')[0] 'payload' — IndexExpressionAst → 'Other' * & ('i'

(
  parsed: ParsedPowerShellCommand,
)

 * entirely, valid=false already returns 'ask' earlier in the chain).
 */
function checkDynamicCommandName(
  parsed: ParsedPowerShellCommand,
): PowerShellSecurityResult {
  for (const cmd of getAllCommands(parsed)) {
    if (cmd.elementType !== 'CommandAst') {
      continue
    }
    const nameElementType = cmd.elementTypes?.[0]
    if (nameElementType !== undefined && nameElementType !== 'StringConstant') {
      return {
        behavior: 'ask',
        message:
          'Command name is a dynamic expression which cannot be statically validated',
      }
    }
  }
  return { behavior: 'passthrough' }
}

/**
 * Checks for encoded command parameters which obscure intent.