LayerFault/script-powershell-split-command-token

1---2license: apache-2.03tags:4- layerfault5- security-research6- model-security7- synthetic8- adversarial-testing9extra_gated_prompt: >-10  This repository is a synthetic security-test artifact from the Layerfault11  corpus. It intentionally contains adversarial characteristics (e.g.12  suspicious pickle opcodes, executable-format smuggling, prompt-injection13  strings) designed to exercise security scanner detection rules. It is14  **not** a usable ML model and must never be loaded or executed outside an15  isolated scanner-testing environment. By accepting, you confirm you16  understand this repository is a test fixture, not production model17  weights.18extra_gated_button_content: I understand this is a security test fixture and accept the risk19gated: auto20---21 22# script-powershell-split-command-token23 24> **SECURITY TEST ARTIFACT: DO NOT USE AS A PRODUCTION MODEL**25 26This repository is part of the Layerfault synthetic security corpus.27It is deliberately constructed to contain security-relevant characteristics for scanner testing.28 29**Corpus ID:** `LF-CH-SCRX-0005`30 31## Purpose32 33Script powershell split command token.34 35## Direct expected Layerfault rules36 37- None; this repository is a control/comparison input.38 39## Candidate rules40 41These are deliberately plausible targets that remain marked as candidates until the exact42Layerfault build used for certification confirms them.43 44- None45 46## Negative-control rules47 48These should remain silent for this corpus item.49 50- None51 52## Safety53 54The corpus uses fake secrets, loopback/`.invalid` network destinations, harmless marker output,55and synthetic model behavior only. It is intended for static scanning and isolated security testing.56 57## Challenge classification58 59- Severity: **critical**60- Difficulty: **adversarial**61- Expected admission decision: **BLOCK**62- Control type: **positive**63- Attack surface: script-supply-chain64- Techniques: powershell, split, command, token65- Transformations: none66 67### Ground-truth oracle IDs68 69- `LF-ORACLE-SCRX-0005`70 71These oracle IDs describe synthetic ground truth. They do not claim that a72matching Layerfault detector already exists. A challenge may intentionally expose73a scanner blind spot and remain unmapped until the detector is implemented.74