The formatter treats PowerShell source as untrusted text. It must never execute source, import modules, inspect user command metadata implicitly, or require a PowerShell runspace.

Please report security issues privately through GitHub's security advisory mechanism once enabled for the repository.