security-scan

To audit PowerShell scripts for destructive commands, you run a security scan that checks for operations like Remove-Item, Set-Content, Move-Item, git clean, or git reset. It flags these scripts as INVALID to enforce safe execution policies and maintain read-only boundaries.

A read-only guardrail in PowerShell automation is a pre-flight policy validation check that ensures scripts operate within safe execution boundaries. It prevents destructive commands from running in protected paths, satisfying requirements for non-destructive testing and repository maintenance.

Enforcing execution policy adherence for workstation automation scripts requires applying pre-flight checks and policy validation. This process verifies that the script respects read-only boundaries and provides safe defaults to ensure reliable, non-destructive validation.

Yes, PowerShell script safety scanning works with protected git worktrees by applying explicit guards against dangerous commands. It validates execution policies and prevents destructive git operations like git clean or git reset within those protected paths.

The limitations of non-destructive testing for PowerShell scripts involve relying on predefined safe defaults and explicit guards against known dangerous commands. It focuses on policy validation and read-only enforcement rather than catching novel or dynamically generated malicious code.