Function checkPwshCommandOrFile

src/tools/PowerShellTool/powershellSecurity.ts:192–205

* Checks for PowerShell re-invocation (nested pwsh/powershell process). * * Any PowerShell executable in command position is flagged — not just * -Command/-File. Bare `pwsh` receiving stdin (`Get-Content x | pwsh`) or * a positional script path executes arbitrary code with none of the explicit

(
  parsed: ParsedPowerShellCommand,
)

 * process will run.
 */
function checkPwshCommandOrFile(
  parsed: ParsedPowerShellCommand,
): PowerShellSecurityResult {
  for (const cmd of getAllCommands(parsed)) {
    if (isPowerShellExecutable(cmd.name)) {
      return {
        behavior: 'ask',
        message:
          'Command spawns a nested PowerShell process which cannot be validated',
      }
    }
  }
  return { behavior: 'passthrough' }
}

/**
 * Checks for download cradle patterns - common malware techniques