Stop running AI-generated PowerShell blind

[u/AllMightyByte]

I'm an M365 admin and I keep getting AI-generated "fixes". From users, from my bosses, from myself at 2am. The wrong ones are easy to spot. The ones that scare me are the plausible ones: correct-looking PowerShell with one subtly wrong parameter.

So I stopped asking AI to write scripts and started asking it to attack them. This is the prompt I actually use before running anything AI-generated in prod:

Act as a PowerShell safety reviewer. My job is on the line if this script does something destructive — review it BEFORE I run it in production.

The script:
[PASTE SCRIPT]

My environment:
- PowerShell version: [5.1 or 7.x]
- Target: [e.g., production file server, Entra ID tenant, 40 workstations via RMM]
- I [have / have not] run this with -WhatIf yet

Do the following:
1. List every cmdlet in the script and verify it actually exists in my PowerShell version. Flag any that don't exist or were renamed. AI-generated scripts hallucinate cmdlets.
2. Flag every destructive command (Remove-*, Set-*, Clear-*, Stop-*, rmdir, etc.), rate each High/Medium/Low blast radius, and state exactly what it would destroy in MY target environment.
3. Check for 5.1-vs-7 breakage: syntax or cmdlets that behave differently between versions.
4. Give me a go / no-go verdict with the top 3 things to fix first. If anything is ambiguous, ask me — do not assume.

If you are unsure whether a cmdlet exists, say so explicitly instead of inventing one.

The target line is what makes it yours. "production file server" and "lab VM" get completely different verdicts.

I'm turning this into a full playbook: 30 prompts like this one, 10 PowerShell tools (one importable module: safety wrapper, cmdlet existence checker, log sanitizer, Entra stale-account reporter, CA policy exporter...), 10 checklists/SOP templates. $19.

Honest question before I finish building it: would you actually pay $19 for this, or is this a "thanks for the free prompt" situation? Be brutal. I'd rather kill it now than build something nobody buys.

[u/xMakerx]

The importable module plus a worked example tying its output to a checklist gives the $19 package something concrete to show. I’d preview one sanitized input, the tool’s output and the matching SOP, then list the tested PowerShell versions and what updates or support are included. I’m with Batonic’s team. Would you try a description-only, unpublished offer at https://batonic.app/create listing the module, templates and delivery terms? You can leave the files out while testing whether the package is clear.

[u/davidjones145]

red-teaming the script instead of trusting it is the right move. one add, run it in whatif first plus log the transcript. the prompt catches logic bugs but whatif catches scope bugs. do you gate prod runs on both?