Security audit
Security checks for vulnerabilities and agentic risk
This toolkit needs review because it runs unverified downloads from third-party proxies and can erase existing shell configuration during setup.
Start with -CheckOnly. Prefer a separately verified installation using [Microsoft's installation guide](https://learn.microsoft.com/en-us/powershell/scripting/install/install-powershell-on-windows). Back up both PowerShell profiles and terminal/editor settings before setup. -SkipDefaults avoids configuration changes but still installs executable files and does not disable proxy downloads. Avoid the README's unrestricted deletion example; seek fixes for download verification and configuration preservation before using default setup.
scripts/install.ps1Third-party proxy responses are trusted as executable releases
A proxy serving substituted binaries can obtain arbitrary code execution as the current user. With defaults enabled, the substituted PowerShell executable can also become the user's configured shell.
Referenced artifact was not completely inspected
assets/icon.png 512x512 图标
Referenced artifact was not completely inspected
scripts/install.ps1 主安装器（幂等，跨机器）
Referenced artifact was not completely inspected
scripts/setup-defaults.ps1 默认化（profile/注册表/文件关联/快捷方式/终端/VSCode）
Referenced artifact was not completely inspected
scripts/wt-config.ps1 WT/VSCode 配置的文本级改写（保留注释，可被测试单独调用）
Referenced artifact was not completely inspected
scripts/smoke-test.ps1 40 项回归测试（隔离沙箱，不碰系统配置，退出码可接 CI）
The example fd -x rm {} executes a deletion command for every discovered result without a search restriction, preview, or explicit warning. Where an external rm executable is available, copying this example can delete files recursively discovered under the current directory; presenting it as routine usage in an agent-oriented toolkit increases the risk of accidental execution.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl.exe -s https://api.github.com/repos/PowerShell/PowerShell | jq .tag_name
Get-Content data.json | jq ".[] | .name"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
function Get-LatestTag {
param([string]$Repo)
try {
$r = Invoke-RestMethod -Uri "https://api.github.com/repos/$Repo/releases/latest" `
-Headers @{ 'User-Agent'='ps7-toolkit' } -TimeoutSec 25
return $r.tag_name
} catch { return $null }
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
function Resolve-ReleaseAssetUrl {
param([string]$Repo, [string]$Tag, [string]$Pattern, [string]$FallbackAsset)
try {
$r = Invoke-RestMethod -Uri "https://api.github.com/repos/$Repo/releases/tags/$Tag" `
-Headers @{ 'User-Agent'='ps7-toolkit' } -TimeoutSec 25
$a = $r.assets | Where-Object {
$_.name -like "*$Pattern*" -and $_.name -notmatch '\.(sha256|sig|asc)$'
Without declared permissions the skill's intent is opaque and cannot be validated.
When an existing profile lacks the 'ps7-toolkit' marker, the script replaces its entire contents rather than preserving unrelated configuration. This can remove user-defined security checks, logging setup, and essential initialization from both PowerShell profiles; the backup reduces recovery costs but does not prevent disruption. Encoding configuration is appropriate for this toolkit, but wholesale replacement exceeds that purpose and is especially risky when invoked automatically to troubleshoot shell problems.
If an existing PowerShell 7 profile lacks a string-valued path, the fallback replaces the entire profile object with a generated object, discarding fields such as args, env, and source. This can remove user-defined execution constraints or environment settings while also making that profile the default terminal; JSON syntax validation will not detect this semantic loss. The behavior contradicts the updater's preservation guarantee, although there is no evidence of malicious intent or direct attacker-controlled execution in this finding.
No suspicious patterns detected.