This is very cool but as someone who's not a pro with Windows API or powershell, how safe is this thing assuming a user-space process has been hijacked by an attacker?
Yes, If any malicious program is running in user land in windows, it can easily bypass UAC. But, as was mentioned when this was being discussed on reddit[0], UAC was never meant to be a fix-all security boundary.