PowerShell Scripts

PowerShell scripts run using PowerShell 7 (pwsh) in Constrained Language Mode with a curated cmdlet whitelist. This prevents scripts from performing dangerous operations while still giving full access to REST APIs, JSON handling, and output formatting.

Allowed cmdlets

Category	Cmdlets
HTTP	Invoke-RestMethod, Invoke-WebRequest
Output	Write-Output, Write-Host, Write-Warning, Write-Error, Write-Verbose
JSON	ConvertTo-Json, ConvertFrom-Json
Data	Select-Object, Where-Object, ForEach-Object, Sort-Object, Group-Object, Measure-Object
String	Format-List, Format-Table, Out-String, ConvertTo-Csv, ConvertFrom-Csv
Math/Date	Get-Date, New-TimeSpan, [Math]::*
Control	if, foreach, while, try/catch/finally, switch

Blocked

• Invoke-Expression — arbitrary code execution
• Add-Type — loading arbitrary .NET assemblies
• Start-Process — spawning child processes
• Get-Content / Set-Content / Remove-Item — filesystem access
• Import-Module (except whitelisted modules)
• $env:* — environment variable access

Injected variables

Variable	Type	Description
$AuthHeaders	Hashtable	Auth headers for the task's configured auth (Basic or custom header)
$datasources	PSObject	Data source connections — see Data Sources
$logger	PSObject	Structured logging — .Info(), .Warn(), .Error(), .Debug()
$payload	string	Webhook or MQTT payload (if triggered by one)

Example: call a REST API

$response = Invoke-RestMethod `
    -Uri "https://api.example.com/orders" `
    -Headers $AuthHeaders `
    -Method GET

$logger.Info("Found $($response.Count) orders")

foreach ($order in $response) {
    if ($order.status -eq "pending") {
        $logger.Warn("Pending order: $($order.id)")
    }
}

$response | ConvertTo-Json

Example: use a data source

# Query a connected PostgreSQL database
$results = $datasources.MyDatabase.Query("SELECT id, name FROM users WHERE active = true")

$logger.Info("Active users: $($results.Count)")
$results | Select-Object id, name | ConvertTo-Json

Example: send to a webhook endpoint

$body = @{
    event   = "nightly-report"
    count   = 42
    status  = "success"
} | ConvertTo-Json

Invoke-RestMethod `
    -Uri "https://hooks.example.com/report" `
    -Method POST `
    -ContentType "application/json" `
    -Body $body `
    -Headers $AuthHeaders

Database drivers

The following PowerShell database drivers are pre-installed and available via $datasources:

• PostgreSQL — Npgsql
• SQL Server — Microsoft.Data.SqlClient
• MySQL / MariaDB — MySqlConnector
• Oracle — Oracle.ManagedDataAccess

Use these through the Data Sources abstraction rather than directly — credentials are injected automatically.