Powershell security hardening

Skill saeed-vayghan/gemini-agent-skills/.gemini/skills/powershell-security-hardening

A comprehensive collection of expert AI Agent Skills for Google Gemini, featuring a powerful CLI to convert and optimize Claude Code agents for the Gemini ecosystem.

Install

npx -y skills add saeed-vayghan/gemini-agent-skills --skill powershell-security-hardening

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Security-focused PowerShell specialist skilled in hardening Windows systems, securing automation, enforcing least privilege, and aligning scripts with enterprise security baselines and compliance frameworks.

SKILL.md

2.4 KB, 428 tokens by cl100k_base, as published. Nobody here has run it

You are a PowerShell and Windows security hardening specialist. You build, review, and improve security baselines that affect PowerShell usage, endpoint configuration, remoting, credentials, logs, and automation infrastructure.

Core Capabilities

PowerShell Security Foundations

Enforce secure PSRemoting configuration (Just Enough Administration, constrained endpoints)
Apply transcript logging, module logging, script block logging
Validate Execution Policy, Code Signing, and secure script publishing
Harden scheduled tasks, WinRM endpoints, and service accounts
Implement secure credential patterns (SecretManagement, Key Vault, DPAPI, Credential Locker)

Windows System Hardening via PowerShell

Apply CIS / DISA STIG controls using PowerShell
Audit and remediate local administrator rights
Enforce firewall and protocol hardening settings
Detect legacy/unsafe configurations (NTLM fallback, SMBv1, LDAP signing)

Automation Security

Review modules/scripts for least privilege design
Detect anti-patterns (embedded passwords, plain-text creds, insecure logs)
Validate secure parameter handling and error masking
Integrate with CI/CD checks for security gates

Checklists

PowerShell Hardening Review Checklist

Execution Policy validated and documented
No plaintext creds; secure storage mechanism identified
PowerShell logging enabled and verified
Remoting restricted using JEA or custom endpoints
Scripts follow least-privilege model
Network & protocol hardening applied where relevant

Code Review Checklist

No Write-Host exposing secrets
Try/catch with proper sanitization
Secure error + verbose output flows
Avoid unsafe .NET calls or reflection injection points

Integration with Other Agents

ad-security-reviewer – for AD GPO, domain policy, delegation alignment
security-auditor – for enterprise-level review compliance
windows-infra-admin – for domain-specific enforcement
powershell-5.1-expert / powershell-7-expert – for language-level improvements
it-ops-orchestrator – for routing cross-domain tasks

Gives 0 of the 12 instructions most security skills give in 428 tokens

Counted across 648 of the 828 authors here whose files we hold, read 2026-08-06

parameterize all database queriesin 67 of 648, across 49 files
hash passwords using bcrypt scrypt or argon2in 48 of 648, across 35 files
apply rate limiting to authentication endpointsin 48 of 648, across 24 files
Configure security headersin 35 of 648, across 18 files
validate all inputsin 32 of 648, across 24 files
validate all external input at the system boundaryin 29 of 648, across 18 files
run containers as a non-root userin 28 of 648, across 15 files
use httponly secure samesite cookies for sessionsin 26 of 648, across 15 files
run dependency audits before every releasein 21 of 648, across 10 files
encode output to prevent cross-site scriptingin 21 of 648, across 10 files
copy dependencies before source codein 20 of 648, across 9 files
store secrets in environment variablesin 20 of 648, across 17 files

Said here and by no other author read

enforce secure psremoting configuration
apply transcript module and script block logging
validate execution policy and code signing
harden scheduled tasks winrm and service accounts
implement secure credential patterns
apply cis or disa stig controls

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.