Search 58 PSRafScan rules by name, category, type, severity, intended use, issue, fix, tag, or alias, and learn how to create your own.
InteractivePrompt
The script may stop and wait for interactive input.
Recommended change: Avoid Read-Host unless interaction is required. Prefer parameters, variables set at the top of the script, or clear noninteractive defaults.
LongSleep
The script uses a long fixed sleep, which can slow execution and hide timing assumptions.
Recommended change: Replace the sleep with a bounded wait loop that checks for the actual condition, or explain why the fixed wait is required.
AutomaticVariableAssignment
The script assigns to a variable name that conflicts with a PowerShell automatic variable.
Recommended change: Rename the assigned variable. Do not assign to automatic variables such as $Host, $PID, $Input, $Error, $PWD, $HOME, $PSItem, or $Matches.
AutomaticVariableParameterName
The script uses a parameter name that conflicts with a PowerShell automatic variable.
Recommended change: Rename the parameter so it does not conflict with automatic variables such as $Host, $PID, $Input, $Error, $PWD, $HOME, $PSItem, or $Matches.
CmdletMissingRequiredParameter
The script appears to call a cmdlet incorrectly or without required parameters.
Recommended change: Correct the cmdlet call so required parameters are supplied and each parameter is used according to the cmdlet contract.
NativeExitCodeNotChecked
The script runs a native command without checking whether it succeeded.
Recommended change: After native commands such as git, cmd, robocopy, npm, python, docker, or code, immediately check $LASTEXITCODE or $? and stop with a clear error if the command failed.
NullComparisonWrongSide
The script compares a value to $null with $null on the right, which can behave incorrectly with collections.
Recommended change: Rewrite null comparisons with $null on the left, such as $null -eq $Value or $null -ne $Value.
ReservedWordFunctionName
The script defines a function using a reserved PowerShell word.
Recommended change: Rename the function so it does not use reserved words such as process, begin, end, filter, class, try, catch, or finally.
UnknownCommand
The script calls a command that is not recognized in this PS7 environment.
Recommended change: Replace the command with one available in PS7, define the function in the script, import the required module, or add an explicit preflight check that fails with a clear message.
ConvertToSecureStringPlainText
The script converts a hard-coded plaintext secret with ConvertTo-SecureString -AsPlainText, which still exposes the secret in the script.
Recommended change: Do not hard-code the secret. Accept a [pscredential] or [securestring] from the caller, or use a secure secret source.
CredentialParameterType
The script has a credential parameter that is not typed as PSCredential.
Recommended change: Change credential parameters to [System.Management.Automation.PSCredential] or [pscredential].
PlainTextPasswordParameter
The script models a password or credential as a plain string, which can expose sensitive information.
Recommended change: Replace password string parameters with [securestring] or use a single [pscredential] parameter.
UsernamePasswordParameterPair
The function uses separate username and password parameters, which makes credential handling less safe.
Recommended change: Replace the username and password pair with a single [pscredential] parameter, or make the password parameter [securestring].
CatchHidesErrorDetails
The catch block hides useful error details or replaces the failure with a generic message.
Recommended change: Rewrite the catch block so it preserves error detail by using throw, Write-Error, or including $_ in the message.
EmptyCatchBlock
The script has an empty catch block, which silently hides failures.
Recommended change: Replace the empty catch block with error handling that uses throw, Write-Error, or records $_ with useful context.
HostOutputInCatchBlock
The script writes host or console output inside a catch block, which can hide failure details or use the wrong error stream.
Recommended change: Use throw, Write-Error, or Write-Warning, and include $_ or useful error context in the message.
SilentErrorAction
The script uses -ErrorAction SilentlyContinue, which can hide failures that should be handled.
Recommended change: Avoid SilentlyContinue unless the failure is intentionally optional. Prefer -ErrorAction Stop with a meaningful catch block, or record the skipped error.
SilentErrorPreference
The script sets $ErrorActionPreference to SilentlyContinue, which can hide failures across the script.
Recommended change: Do not set global error behavior to SilentlyContinue. Use Stop for reliable scripts and handle expected failures locally.
RecursiveForceDelete
The script performs a recursive forced delete without a safety guard.
Recommended change: Validate the target path, reject empty or root paths, and use -WhatIf, ShouldProcess, or an explicit confirmation step before deleting.
RobocopyMirrorOrPurge
The script uses robocopy /MIR or /PURGE, which can delete files from the destination.
Recommended change: Avoid /MIR or /PURGE unless deletion is explicitly intended. Add source and destination validation, explain the deletion risk, and capture robocopy exit codes.
WildcardDelete
The script deletes using a wildcard target, which can delete more than intended.
Recommended change: Resolve and validate the target paths first, reject broad paths, and use -WhatIf, ShouldProcess, or confirmation.
GitCleanForceX
The script uses git clean with force and x, which can delete untracked and ignored files.
Recommended change: Do not use git clean -fdx unless the user explicitly requested deletion of untracked and ignored files. Add a preview step such as git clean -fdxn first.
GitForceDeleteBranch
The script uses git branch -D, which force deletes a branch.
Recommended change: Avoid forced branch deletion unless the user explicitly requested it. Prefer git branch -d or add a branch confirmation step.
GitForcePush
The script uses git push --force, which can overwrite remote history.
Recommended change: Avoid --force. Use --force-with-lease only when the user explicitly requested it and the script explains the risk.
GitNetworkOperation
The script runs a Git command that may contact a remote repository.
Recommended change: Make the remote Git operation explicit, add clear status output, and check the native exit code after the command.
GitResetHard
The script uses git reset --hard, which can discard local work.
Recommended change: Do not use git reset --hard unless the user explicitly requested destructive Git cleanup. Add branch and status checks plus a confirmation gate.
AssignmentInCondition
The script may be using assignment where a comparison was intended.
Recommended change: If this is a comparison, replace = with -eq, -ne, -like, -match, or the intended comparison operator. Use = only for assignment.
CmdletAliasUse
The script uses a PowerShell alias, which makes generated scripts harder to read and less predictable across hosts.
Recommended change: Replace the alias with the full cmdlet name, such as Get-ChildItem instead of ls, gci, or dir.
CommonCmdletPositionalParameterUse
The script appears to call a common cmdlet using positional parameters.
Recommended change: Rewrite the cmdlet call with named parameters such as -Path, -LiteralPath, -Value, -Destination, -ItemType, and -Encoding.
GlobalVariableUse
The script uses global state, which can leak values into the session or collide with other scripts.
Recommended change: Remove $global: usage and use local variables, parameters, return values, or explicit output objects.
UnusedParameter
The function declares a parameter that is never used.
Recommended change: Remove the unused parameter, or update the script so the parameter is used intentionally.
UnusedVariableAssignment
The script assigns a value to a variable that is never used.
Recommended change: Remove the unused variable, or update the script so the assigned value is used.
NetworkOperation
The script runs a command that may send or receive data over the network.
Recommended change: Make the network operation explicit, parameterize the URL or remote target, add error handling, and check success before continuing.
HostOutputForStatus
The script uses host or console output for human-facing status text. In PS7 this is usually not a blocking issue, but it is display-oriented output, not pipeline data.
Recommended change: Prefer Write-Information for user-facing status, Write-Verbose for diagnostics, and Write-Output only for data that should flow through the pipeline.
HostOutputInReusableFunction
The script writes directly to the host or console inside a reusable data or action function, which can hide data from the pipeline or use the wrong output stream.
Recommended change: Return data with Write-Output or implicit output, use Write-Information or Write-Verbose for status or diagnostics, and use Write-Warning, Write-Error, or throw for warnings and failures.
BacktickContinuation
The script uses backtick line continuation, which is fragile and often breaks during copy/paste.
Recommended change: Rewrite the command without backticks by using splatting, arrays, hashtables, parentheses, or natural pipeline continuation.
FunctionInsidePasteWrapper
The script defines functions inside a top-level & { ... } wrapper, so those functions will not remain available in the user session after the wrapper exits.
Recommended change: If the functions must persist after the paste runs, do not put them inside & { ... }. Use paste-safe formatting or a dot-sourced wrapper . { ... } only when persistence is intended.
MarkdownCodeFence
The script contains a raw Markdown code fence line in executable PowerShell code.
Recommended change: Remove Markdown fence lines such as three backticks, ```powershell, ```text, or closing three backticks from the script body. If the script is intentionally creating a Markdown file and needs to write code fences into that file, put those fence lines inside a valid quoted string or here-string that is written to the .md file, not as raw executable script lines.
PasteSensitiveContinuationBlock
The script has a continuation keyword such as else, elseif, catch, or finally that can fail when pasted into a terminal after the prior block executes.
Recommended change: Make the block paste-safe by putting the closing brace and continuation keyword on the same line, such as } else {, } elseif (...) {, } catch {, or } finally {. Another valid fix is to wrap the full paste in a top-level script block such as & { ... }.
PasteSensitiveDoWhile
The script has a do/while block that can be paste-sensitive when the while clause is separated from the do block.
Recommended change: Keep the while (...) continuation attached to the do block, or wrap the full pasted script in a top-level script block such as & { ... }.
PromptTextLine
The script contains copied terminal prompt text, such as PS C:\...> or >>, which is not executable script code.
Recommended change: Remove all prompt text from the generated script so the script contains only PowerShell code.
RequiresInTerminalPaste
The script uses #requires, which belongs in saved .ps1 files and is not appropriate for direct terminal paste.
Recommended change: For TerminalPaste scripts, remove #requires and replace it with explicit runtime checks inside the script, such as checking PS version or Administrator mode.
ScriptFileVariableInTerminalPaste
The script uses script-file variables that are not reliable when pasted directly into a terminal.
Recommended change: For TerminalPaste scripts, do not use $PSScriptRoot or $PSCommandPath. Use an explicit base path, Get-Location, or a variable set at the top of the pasted script.
TopLevelParamInTerminalPaste
The script uses top-level param(), which is for saved .ps1 files and is not appropriate for direct terminal paste.
Recommended change: For TerminalPaste scripts, replace top-level param() with explicit variable assignments near the top of the pasted block, or prompt before the main script block when user input is required.
HardcodedOneDrivePath
The script hard-codes a OneDrive path that may fail under another user, sandbox, or sync state.
Recommended change: Use a parameter, $env:USERPROFILE, a detected path, or an explicit configurable base path instead of a hard-coded OneDrive path.
RelativePathAssumption
The script uses a relative path that depends on the current working directory.
Recommended change: Use an explicit working directory, convert the path to a full path, or resolve it from a declared base path at the top of the script.
PluralNounFunctionName
The function name uses a plural noun, which does not follow PowerShell naming guidance.
Recommended change: Rename the function with a singular noun, such as Get-ItemReport instead of Get-ItemReports.
UnapprovedVerb
The function name uses a verb that is not approved for PowerShell commands.
Recommended change: Rename the function using an approved verb from Get-Verb, such as Get, Set, New, Remove, Test, Invoke, or Update.
LikelyRequiresAdministrator
The script contains an operation that likely requires Administrator mode.
Recommended change: Remove the Administrator-only operation or add an explicit Administrator preflight check at the top of the script. The final run instructions must say Administrator mode is required.
SelfElevation
The script tries to self-elevate with Start-Process -Verb RunAs.
Recommended change: Do not self-elevate inside the script. Require the user to start an Administrator PS7 terminal, or remove the elevation-dependent operation.
StateChangingFunctionWithoutShouldProcess
The function appears to change system state but does not support ShouldProcess.
Recommended change: Add [CmdletBinding(SupportsShouldProcess)] and guard the state-changing operation with $PSCmdlet.ShouldProcess(...).
InvokeExpressionUse
The script uses Invoke-Expression, which executes dynamically built text and can create security and quoting problems.
Recommended change: Remove Invoke-Expression and use direct command invocation, splatting, an argument array, or a validated script block.
BacktickTrailingWhitespace
The script has a backtick followed by trailing whitespace, which breaks PowerShell line continuation.
Recommended change: Remove the trailing whitespace or replace the backtick continuation with splatting, arrays, hashtables, parentheses, or natural pipeline continuation.
GitMergeConflictMarker
The script contains Git merge conflict markers, which means the script is not resolved code.
Recommended change: Resolve the conflict before producing the script. Remove <<<<<<<, =======, and >>>>>>> markers and keep only the intended final PowerShell code.
HereStringTerminatorTrailingText
The script has a here-string terminator with trailing text, which makes the here-string invalid or unreliable.
Recommended change: Put the here-string terminator on its own line with no trailing text after @" or @'.
SystemConfigurationCommand
The script runs a command that often changes system configuration.
Recommended change: Add an Administrator preflight check when required, explain the system change in script output or comments, and make the operation explicit.
NonBreakingSpaceCharacter
The script contains a non-breaking space character, which can look like a normal space but behave differently.
Recommended change: Replace non-breaking spaces with normal spaces throughout the generated script.
SmartQuoteCharacter
The script contains smart quotes, which can break PowerShell parsing or string handling.
Recommended change: Replace smart quotes with plain ASCII quotes: use ' or " instead of curly quote characters.