I have a small proposal for the comment in the Windows agent YML file.
The explanation of the default value for extensions being executed is imho misleading:
# Do only execute programs and scripts with # the following suffixes (in local and plugins). # Per default *all extensions* except txt and dir # are being executed. # execute: exe bat vbs cmd ps1
could be understood as the agent executes everything per default.
But in fact, it only executes all of the extensions which are named in the commented line below.
Naive individuals like me could understand that you only have to uncomment the line “execute” if you want to limit the executable plugins to something other than “all extensions”.
Furthermore, as soon as you have changed the line, you lost the information about the default setting.
# Per default the extensions exe/bat/vbs/cmd/ps1 # are being executed.
PS: Why not include also .py to the defaults?