What
A dedicated PowerShell command execution tool for Windows users, providing native PowerShell syntax support with comprehensive security analysis.
Details
- Enabled via the
CLAUDE_CODE_USE_POWERSHELL_TOOLenvironment variable on Windows - Uses
pwsh(PowerShell 7+) for command parsing and execution - Full AST-based security analysis of PowerShell commands before execution
- Validates PowerShell-specific patterns: cmdlet names, parameter types, pipeline chains,
.NETtype usage, script blocks - Recognizes dangerous patterns:
Invoke-Expression, encoded commands, COM object creation, module loading, splatting, UNC paths - Read-only cmdlets (e.g.
Get-ChildItem,Get-Content,Select-String,Get-Process) are auto-allowed - Handles PowerShell-specific security concerns:
-FilePathexecution,-Commandre-invocation,Start-Processnesting - Provides PowerShell syntax guidance in tool description (variable syntax, pipe objects, here-strings, cmdlet naming)
- Falls back gracefully if PowerShell is not installed
- Enterprise policy enforcement: sandboxing policy blocks shell execution on native Windows when sandbox is unavailable
Evidence
PowerShell tool implementation (search for "PowerShell command", "CLAUDE_CODE_USE_POWERSHELL_TOOL", "Run PowerShell command")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.