Function checkModuleLoading

src/tools/PowerShellTool/powershellSecurity.ts:946–960

* Module-loading cmdlets execute a .psm1's top-level script body (Import-Module) * or download from arbitrary repositories (Install-Module, Save-Module). A * wildcard allow rule like `Import-Module:*` would let an attacker-supplied * .psm1 execute with the user's privileges — same risk as Invoke-

(
  parsed: ParsedPowerShellCommand,
)

 */

function checkModuleLoading(
  parsed: ParsedPowerShellCommand,
): PowerShellSecurityResult {
  for (const cmd of getAllCommands(parsed)) {
    const lower = cmd.name.toLowerCase()
    if (MODULE_LOADING_CMDLETS.has(lower)) {
      return {
        behavior: 'ask',
        message:
          'Command loads, installs, or downloads a PowerShell module or script, which can execute arbitrary code',
      }
    }
  }
  return { behavior: 'passthrough' }
}

/**
 * Set-Alias/New-Alias can hijack future command resolution: after