# PowerShell Clinic

> Review a PowerShell script for Windows PowerShell pitfalls, or harden it. Paste the script and get a free scan; a
> metered run fixes the pitfalls or hardens the script, and the page re-scans the result and checks every parameter
> and function is kept. Built on the SkillSafe skills @sickn33/powershell-windows and @josiahsiegel/powershell-security.
> Not affiliated with Microsoft.

https://pwsh-clinic.skillsafe.ai/

## What is free
- Syntax: cmdlet calls next to -and / -or without their own parentheses (parsed as parameters of the first cmdlet).
- Nulls: $null on the right of -eq / -ne; .Count compared on a value that may be a single object or $null.
- Errors: no Set-StrictMode; try blocks whose cmdlets raise non-terminating errors that catch never sees; native executables (robocopy, git, msiexec and others) with no $LASTEXITCODE check.
- Data, paths and output: ConvertTo-Json without -Depth; paths built by string concatenation; paths relative to the current directory instead of $PSScriptRoot; non-ASCII log text a 5.1 host may garble; Out-File / Set-Content without -Encoding.
- Security: credentials and connection strings written into the script; ConvertTo-SecureString from a literal; SQL built by interpolating variables; Invoke-Expression; -ExecutionPolicy Bypass; certificate validation switched off; secrets written to the host or a log; parameters that reach a path, a query or a command without a Validate attribute.
- The interface the fixes must keep (parameters and functions), a findings CSV and the scan as Markdown.

## The metered lanes
Two tasks on gpt-terra, metered per run, routed by `task`. Input string fields: `task` (review or harden), `code`, `shell` (5.1, 7 or both), `facts` (the page's scan) and the optional `focus`.
- `review` replies with `verdict` (ship, refactor, rework), `summary`, `findings` (rule, severity, title, where, why, fix), `prescan`, `rewrite` (the whole fixed script), `kept` and `caveats`. The page requires every PW- error and warning answered by rule id, refuses ship over an undisputed error, and re-scans the rewrite: findings still there or newly introduced, parameters and functions lost, PowerShell 7-only syntax in a 5.1 script.
- `harden` adds `secrets` (every name the script passes to Get-Secret, and what it is for) and `run` (signing, execution policy, the account). The page re-scans the hardened script for the PS- findings, and checks every Get-Secret name is listed.
- Nothing is run; try the result with -WhatIf and Invoke-ScriptAnalyzer first.

## Links
- API tutorial: https://pwsh-clinic.skillsafe.ai/api.html
- Source skills: https://skillsafe.ai/skill/@sickn33/powershell-windows, https://skillsafe.ai/skill/@josiahsiegel/powershell-security