Search the current PSRafScan rule catalog by name, category, type, severity, intended use, and purpose, then learn how to create rules and self-tests.
InteractivePrompt
The script may stop and wait for interactive input.
Review direction: Avoid Read-Host unless interaction is required. Prefer parameters, variables set at the top of the script, or clear noninteractive defaults.
LongSleep
The script uses a long fixed sleep, which can slow execution and hide timing assumptions.
Review direction: Replace the sleep with a bounded wait loop that checks for the actual condition, or explain why the fixed wait is required.
AutomaticVariableAssignment
The script assigns to a variable name that conflicts with a PowerShell automatic variable.
Review direction: Rename the assigned variable. Do not assign to automatic variables such as $Host, $PID, $Input, $Error, $PWD, $HOME, $PSItem, or $Matches.
AutomaticVariableParameterName
The script uses a parameter name that conflicts with a PowerShell automatic variable.
Review direction: Rename the parameter so it does not conflict with automatic variables such as $Host, $PID, $Input, $Error, $PWD, $HOME, $PSItem, or $Matches.
CmdletMissingRequiredParameter
The script appears to call a cmdlet incorrectly or without required parameters.
Review direction: Correct the cmdlet call so required parameters are supplied and each parameter is used according to the cmdlet contract.
NativeExitCodeNotChecked
The script runs a native command without checking whether it succeeded.
Review direction: After native commands such as git, cmd, robocopy, npm, python, docker, or code, immediately check $LASTEXITCODE or $? and stop with a clear error if the command failed.
NullComparisonWrongSide
The script compares a value to $null with $null on the right, which can behave incorrectly with collections.
Review direction: Rewrite null comparisons with $null on the left, such as $null -eq $Value or $null -ne $Value.
ReservedWordFunctionName
The script defines a function using a reserved PowerShell word.
Review direction: Rename the function so it does not use reserved words such as process, begin, end, filter, class, try, catch, or finally.
UnknownCommand
The script calls a command that is not recognized in this PS7 environment.
Review direction: Replace the command with one available in PS7, define the function in the script, import the required module, or add an explicit preflight check that fails with a clear message.
ConvertToSecureStringPlainText
The script converts a hard-coded plaintext secret with ConvertTo-SecureString -AsPlainText, which still exposes the secret in the script.
Review direction: Do not hard-code the secret. Accept a [pscredential] or [securestring] from the caller, or use a secure secret source.
CredentialParameterType
The script has a credential parameter that is not typed as PSCredential.
Review direction: Change credential parameters to [System.Management.Automation.PSCredential] or [pscredential].
PlainTextPasswordParameter
The script models a password or credential as a plain string, which can expose sensitive information.
Review direction: Replace password string parameters with [securestring] or use a single [pscredential] parameter.
UsernamePasswordParameterPair
The function uses separate username and password parameters, which makes credential handling less safe.
Review direction: Replace the username and password pair with a single [pscredential] parameter, or make the password parameter [securestring].
CatchHidesErrorDetails
The catch block hides useful error details or replaces the failure with a generic message.
Review direction: Rewrite the catch block so it preserves error detail by using throw, Write-Error, or including $_ in the message.
EmptyCatchBlock
The script has an empty catch block, which silently hides failures.
Review direction: Replace the empty catch block with error handling that uses throw, Write-Error, or records $_ with useful context.
HostOutputInCatchBlock
The script writes host or console output inside a catch block, which can hide failure details or use the wrong error stream.
Review direction: Use throw, Write-Error, or Write-Warning, and include $_ or useful error context in the message.
SilentErrorAction
The script uses -ErrorAction SilentlyContinue, which can hide failures that should be handled.
Review direction: Avoid SilentlyContinue unless the failure is intentionally optional. Prefer -ErrorAction Stop with a meaningful catch block, or record the skipped error.
SilentErrorPreference
The script sets $ErrorActionPreference to SilentlyContinue, which can hide failures across the script.
Review direction: Do not set global error behavior to SilentlyContinue. Use Stop for reliable scripts and handle expected failures locally.
RecursiveForceDelete
The script performs a recursive forced delete without a safety guard.
Review direction: Validate the target path, reject empty or root paths, and use -WhatIf, ShouldProcess, or an explicit confirmation step before deleting.
RobocopyMirrorOrPurge
The script uses robocopy /MIR or /PURGE, which can delete files from the destination.
Review direction: Avoid /MIR or /PURGE unless deletion is explicitly intended. Add source and destination validation, explain the deletion risk, and capture robocopy exit codes.
WildcardDelete
The script deletes using a wildcard target, which can delete more than intended.
Review direction: Resolve and validate the target paths first, reject broad paths, and use -WhatIf, ShouldProcess, or confirmation.
GitCleanForceX
The script uses git clean with force and x, which can delete untracked and ignored files.
Review direction: Do not use git clean -fdx unless the user explicitly requested deletion of untracked and ignored files. Add a preview step such as git clean -fdxn first.
GitForceDeleteBranch
The script uses git branch -D, which force deletes a branch.
Review direction: Avoid forced branch deletion unless the user explicitly requested it. Prefer git branch -d or add a branch confirmation step.
GitForcePush
The script uses git push --force, which can overwrite remote history.
Review direction: Avoid --force. Use --force-with-lease only when the user explicitly requested it and the script explains the risk.
GitNetworkOperation
The script runs a Git command that may contact a remote repository.
Review direction: Make the remote Git operation explicit, add clear status output, and check the native exit code after the command.
GitResetHard
The script uses git reset --hard, which can discard local work.
Review direction: Do not use git reset --hard unless the user explicitly requested destructive Git cleanup. Add branch and status checks plus a confirmation gate.
AssignmentInCondition
The script may be using assignment where a comparison was intended.
Review direction: If this is a comparison, replace = with -eq, -ne, -like, -match, or the intended comparison operator. Use = only for assignment.
CmdletAliasUse
The script uses a PowerShell alias, which makes generated scripts harder to read and less predictable across hosts.
Review direction: Replace the alias with the full cmdlet name, such as Get-ChildItem instead of ls, gci, or dir.
CommonCmdletPositionalParameterUse
The script appears to call a common cmdlet using positional parameters.
Review direction: Rewrite the cmdlet call with named parameters such as -Path, -LiteralPath, -Value, -Destination, -ItemType, and -Encoding.
GlobalVariableUse
The script uses global state, which can leak values into the session or collide with other scripts.
Review direction: Remove $global: usage and use local variables, parameters, return values, or explicit output objects.
UnusedParameter
The function declares a parameter that is never used.
Review direction: Remove the unused parameter, or update the script so the parameter is used intentionally.
UnusedVariableAssignment
The script assigns a value to a variable that is never used.
Review direction: Remove the unused variable, or update the script so the assigned value is used.
NetworkOperation
The script runs a command that may send or receive data over the network.
Review direction: Make the network operation explicit, parameterize the URL or remote target, add error handling, and check success before continuing.
HostOutputForStatus
The script uses host or console output for human-facing status text. In PS7 this is usually not a blocking issue, but it is display-oriented output, not pipeline data.
Review direction: Prefer Write-Information for user-facing status, Write-Verbose for diagnostics, and Write-Output only for data that should flow through the pipeline.
HostOutputInReusableFunction
The script writes directly to the host or console inside a reusable data or action function, which can hide data from the pipeline or use the wrong output stream.
Review direction: Return data with Write-Output or implicit output, use Write-Information or Write-Verbose for status or diagnostics, and use Write-Warning, Write-Error, or throw for warnings and failures.
BacktickContinuation
The script uses backtick line continuation, which is fragile and often breaks during copy/paste.
Review direction: Rewrite the command without backticks by using splatting, arrays, hashtables, parentheses, or natural pipeline continuation.
FunctionInsidePasteWrapper
The script defines functions inside a top-level & { ... } wrapper, so those functions will not remain available in the user session after the wrapper exits.
Review direction: If the functions must persist after the paste runs, do not put them inside & { ... }. Use paste-safe formatting or a dot-sourced wrapper . { ... } only when persistence is intended.
MarkdownCodeFence
The script contains a raw Markdown code fence line in executable PowerShell code.
Review direction: Remove Markdown fence lines such as three backticks, ```powershell, ```text, or closing three backticks from the script body. If the script is intentionally creating a Markdown file and needs to write code fences into that file, put those fence lines inside a valid quoted string or here-string that is written to the .md file, not as raw executable script lines.
PasteSensitiveContinuationBlock
The script has a continuation keyword such as else, elseif, catch, or finally that can fail when pasted into a terminal after the prior block executes.
Review direction: Make the block paste-safe by putting the closing brace and continuation keyword on the same line, such as } else {, } elseif (...) {, } catch {, or } finally {. Another valid fix is to wrap the full paste in a top-level script block such as & { ... }.
PasteSensitiveDoWhile
The script has a do/while block that can be paste-sensitive when the while clause is separated from the do block.
Review direction: Keep the while (...) continuation attached to the do block, or wrap the full pasted script in a top-level script block such as & { ... }.
PromptTextLine
The script contains copied terminal prompt text, such as PS C:\...> or >>, which is not executable script code.
Review direction: Remove all prompt text from the generated script so the script contains only PowerShell code.
RequiresInTerminalPaste
The script uses #requires, which belongs in saved .ps1 files and is not appropriate for direct terminal paste.
Review direction: For TerminalPaste scripts, remove #requires and replace it with explicit runtime checks inside the script, such as checking PS version or Administrator mode.
ScriptFileVariableInTerminalPaste
The script uses script-file variables that are not reliable when pasted directly into a terminal.
Review direction: For TerminalPaste scripts, do not use $PSScriptRoot or $PSCommandPath. Use an explicit base path, Get-Location, or a variable set at the top of the pasted script.
TopLevelParamInTerminalPaste
The script uses top-level param(), which is for saved .ps1 files and is not appropriate for direct terminal paste.
Review direction: For TerminalPaste scripts, replace top-level param() with explicit variable assignments near the top of the pasted block, or prompt before the main script block when user input is required.
HardcodedOneDrivePath
The script hard-codes a OneDrive path that may fail under another user, sandbox, or sync state.
Review direction: Use a parameter, $env:USERPROFILE, a detected path, or an explicit configurable base path instead of a hard-coded OneDrive path.
RelativePathAssumption
The script uses a relative path that depends on the current working directory.
Review direction: Use an explicit working directory, convert the path to a full path, or resolve it from a declared base path at the top of the script.
PluralNounFunctionName
The function name uses a plural noun, which does not follow PowerShell naming guidance.
Review direction: Rename the function with a singular noun, such as Get-ItemReport instead of Get-ItemReports.
UnapprovedVerb
The function name uses a verb that is not approved for PowerShell commands.
Review direction: Rename the function using an approved verb from Get-Verb, such as Get, Set, New, Remove, Test, Invoke, or Update.
LikelyRequiresAdministrator
The script contains an operation that likely requires Administrator mode.
Review direction: Remove the Administrator-only operation or add an explicit Administrator preflight check at the top of the script. The final run instructions must say Administrator mode is required.
SelfElevation
The script tries to self-elevate with Start-Process -Verb RunAs.
Review direction: Do not self-elevate inside the script. Require the user to start an Administrator PS7 terminal, or remove the elevation-dependent operation.
StateChangingFunctionWithoutShouldProcess
The function appears to change system state but does not support ShouldProcess.
Review direction: Add [CmdletBinding(SupportsShouldProcess)] and guard the state-changing operation with $PSCmdlet.ShouldProcess(...).
InvokeExpressionUse
The script uses Invoke-Expression, which executes dynamically built text and can create security and quoting problems.
Review direction: Remove Invoke-Expression and use direct command invocation, splatting, an argument array, or a validated script block.
BacktickTrailingWhitespace
The script has a backtick followed by trailing whitespace, which breaks PowerShell line continuation.
Review direction: Remove the trailing whitespace or replace the backtick continuation with splatting, arrays, hashtables, parentheses, or natural pipeline continuation.
GitMergeConflictMarker
The script contains Git merge conflict markers, which means the script is not resolved code.
Review direction: Resolve the conflict before producing the script. Remove <<<<<<<, =======, and >>>>>>> markers and keep only the intended final PowerShell code.
HereStringTerminatorTrailingText
The script has a here-string terminator with trailing text, which makes the here-string invalid or unreliable.
Review direction: Put the here-string terminator on its own line with no trailing text after @" or @'.
SystemConfigurationCommand
The script runs a command that often changes system configuration.
Review direction: Add an Administrator preflight check when required, explain the system change in script output or comments, and make the operation explicit.
NonBreakingSpaceCharacter
The script contains a non-breaking space character, which can look like a normal space but behave differently.
Review direction: Replace non-breaking spaces with normal spaces throughout the generated script.
SmartQuoteCharacter
The script contains smart quotes, which can break PowerShell parsing or string handling.
Review direction: Replace smart quotes with plain ASCII quotes: use ' or " instead of curly quote characters.
This server-rendered catalog contains 58 active rules from PSRafScan 0.2.0-alpha1, reviewed 2026-07-12. No rule detail routes are published because the Day 1 quality gate requires a complete verified trigger, non-trigger, fix, and test record for each detail page.