Function checkSplatting

src/tools/PowerShellTool/powershellSecurity.ts:746–756

* AST-only check: Detects splatting (@variable) which can obscure arguments.

(
  parsed: ParsedPowerShellCommand,
)

 * AST-only check: Detects splatting (@variable) which can obscure arguments.
 */
function checkSplatting(
  parsed: ParsedPowerShellCommand,
): PowerShellSecurityResult {
  if (deriveSecurityFlags(parsed).hasSplatting) {
    return {
      behavior: 'ask',
      message: 'Command uses splatting (@variable)',
    }
  }
  return { behavior: 'passthrough' }
}

/**
 * AST-only check: Detects stop-parsing token (--%) which prevents further parsing.