---
name: windows-safety
description: Safe defaults for AI coding agents on Windows. Use before destructive commands, privilege elevation, ExecutionPolicy changes, Defender exclusions, PATH or registry edits, credential handling, or when an agent suggests admin PowerShell, recursive deletes, or disabling security features.
license: MIT
metadata:
  author: javeckbila
  version: "1.0.0"
  platform: windows
---

# Windows safety for coding agents

## Non-negotiables

1. **No silent admin elevation.** If a step needs Administrator, stop and explain why.
2. **No disabling Defender / SmartScreen / UAC** unless the user explicitly requests it and understands the risk.
3. **No recursive delete** outside the project workspace without resolving the full path and confirming intent.
4. **No committing secrets** (`.env`, `*.pfx`, connection strings, Azure publish profiles, `id_rsa`).
5. **No drive-wide searches that rewrite files** (`Get-ChildItem C:\ -Recurse` + mass edit).

## High-risk command patterns

| Pattern | Risk | Safer alternative |
|---------|------|-------------------|
| `Remove-Item -Recurse -Force C:\...` | Data loss | Scope to repo; `git clean` with dry-run |
| `Format-`, `diskpart`, partition tools | Catastrophic | Refuse unless hardware recovery task |
| `Set-ExecutionPolicy Unrestricted` (machine) | Weakens host | Per-process Bypass for one script |
| `netsh advfirewall` broad opens | Exposure | Prefer localhost binds |
| Editing `HKLM:\...` | System-wide breakage | Prefer user-level or project config |
| Downloading `| iex` from unknown URLs | Remote code exec | Download, show hash, user reviews |
| Storing PAT in plaintext repo files | Credential leak | `gh auth`, env vars, secret stores |

## Safe delete workflow

```powershell
$target = Resolve-Path -LiteralPath '.\build'
# show what will go
Get-ChildItem -LiteralPath $target -Recurse | Select-Object -First 20 FullName
# only then
Remove-Item -LiteralPath $target -Recurse -Force
```

For git cruft:

```powershell
git clean -fdn    # dry run first
git clean -fd     # after user ok
```

## Execution policy (minimal privilege)

```powershell
# Good: one script
pwsh -NoProfile -ExecutionPolicy Bypass -File .\scripts\tool.ps1

# Bad: permanent machine policy change by default
Set-ExecutionPolicy -Scope LocalMachine -ExecutionPolicy Unrestricted
```

## Secrets and env

```powershell
# Process-scoped for session
$env:API_KEY = $userProvided   # do not echo back in logs

# Prefer
gh auth token                 # when using GitHub
# or OS credential manager — not files in the repo
```

Add to `.gitignore` when creating env files:

```gitignore
.env
.env.*
!.env.example
*.pfx
*.snk
appsettings.*.local.json
```

## Network and servers

- Bind dev servers to `127.0.0.1` when possible
- Do not open firewall rules for public WAN without user request
- Do not disable TLS verification (`curl -k`, `NODE_TLS_REJECT_UNAUTHORIZED=0`) except temporary debug with warning

## Privilege checklist before `Start-Process -Verb RunAs`

Ask: can this work with:

1. User-level install (`scoop`, per-user `npm prefix`, `dotnet tool --local`)?
2. Repo-local config?
3. Documented manual admin step for the human?

If yes → do not elevate.

## Incident response if the agent already did something risky

1. Stop further destructive steps
2. Report exactly what ran (command + path)
3. Suggest remediation (`git checkout`, recycle bin, shadow copies — only if applicable)
4. Do not hide failures

## Quick allow / deny

| Allow freely in project | Require explicit user intent |
|-------------------------|------------------------------|
| Create/edit files under repo | Anything under `$env:WINDIR` |
| `npm install` / `dotnet restore` | Global PATH machine changes |
| Local git commits (if asked) | Force push, git config --global identity overwrite |
| Start local dev server | Firewall / public bind 0.0.0.0 |
| Read logs under repo | Dumping other users' profiles |