Sample: PowerShell — see SquidGate detect findings

[DotNetRussell]

SquidGate language sample — PowerShell

This PR intentionally introduces insecure patterns so you can see SquidGate work on PowerShell:

• Hardcoded secret / credential
• Injection and/or dangerous API usage

File

examples/powershell/Demo.ps1

What to look for

1. Check run named SquidGate
2. Line annotations on the sample file
3. PR comment summarizing findings
4. Check failure when severity ≥ block_on (default high)

Demo only. Do not merge these patterns into production apps.

All language samples · Setup SquidGate on your repo

[github-actions]

🛡️ Security Scan Results

The changes introduce a new demo script containing a hardcoded credential, SQL injection via string concatenation, and use of the dangerous Invoke-Expression function.

⛔ 3 finding(s) block merge.

HIGH — Hardcoded API Key

File: examples/powershell/Demo.ps1:2 | Confidence: high

An API key is hardcoded directly in the source code as $ApiKey, exposing credentials if the script is shared, logged, or committed to version control.

CWE: CWE-798 | OWASP: A07:2021

Recommendation: Remove the hardcoded value and retrieve the API key from environment variables or a secure secrets manager (e.g., $ApiKey = $env:API_KEY).

---

HIGH — SQL Injection

File: examples/powershell/Demo.ps1:7 | Confidence: high

User input from $Id is directly concatenated into the SQL query string without parameterization or escaping, enabling SQL injection attacks via Invoke-Sqlcmd.

CWE: CWE-89 | OWASP: A03:2021

Recommendation: Use parameterized queries: Invoke-Sqlcmd -Query 'SELECT * FROM users WHERE id = @id' -Variable @{Id=$Id}

---

HIGH — Dangerous Use of Invoke-Expression

File: examples/powershell/Demo.ps1:14 | Confidence: high

Invoke-Expression is called directly on untrusted user input $Code, allowing arbitrary code execution and remote code execution if input is attacker-controlled.

CWE: CWE-95 | OWASP: A03:2021

Recommendation: Avoid Invoke-Expression with untrusted data. Use direct function calls, approved cmdlets, or strict input validation and whitelisting.

---