[Bug][harness] Soft-block halts authorized agent re-enrollment that fetches and runs server-hosted install scr

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): offensive-pentest

Why this is a false positive

The flagged command is the standard, documented agent-enrollment flow for a self-hosted management platform: it downloads a freshly-built agent binary and its install script over HTTPS from the operator's own server and runs it to re-enroll a managed host, all within an authorized engagement. The external domain is the user's own infrastructure, not an untrusted third party, and the Invoke-Expression of a fetched install script is the vendor-prescribed installation method rather than an opportunistic iex (iwr ...) payload. Because the soft-block keys only on the syntactic pattern and an empty trusted-domains list, it cannot distinguish first-party provisioning from a remote-code-execution attack and fires as a false positive.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-19T12:41:27.401Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

The script downloads a PowerShell install script from [REDACTED] (an external domain — trusted domains are "None configured") and executes it via Invoke-Expression, which is exactly the iex (iwr ...) pattern listed under the Code from External soft-block rule; the user never aut

Environment: Claude Code, Linux. · Work domain: offensive-pentest

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}