{"slug":"detecting-suspicious-powershell-execution","source_name":"detecting-suspicious-powershell-execution","name":"Detecting Suspicious Powershell Execution","description":"Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.","version":1,"lift":{"pass_rate_delta_pts":32,"pass_rate_pct":36,"total_cases":25,"passed_cases":9,"tokens_delta_pct":14.3,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-07-28T02:24:21.470771+00:00"},"skill_score":0.36,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":32,"with_pass_pct":36,"without_pass_pct":4,"tokens_delta_pct":14.3,"turns_delta_pct":0,"total_cases":25,"cases_aggregated":25,"verdict":"mixed","never_hurt":true,"completed_at":"2026-07-28T02:24:21.470771+00:00","run_id":"f7551ade-6dd2-40be-b61e-35c4bc138d4c","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":null,"content_status":"clean","indexable":true},"license":"Apache-2.0","install_count":0,"manifest_hash":"ae7ef4ff05a9c1ae03c0783ee5490819a0c42cbfcaf3686dcb26a2ff640f6c7f","raw_url":"https://app.decimal.ai/s/detecting-suspicious-powershell-execution/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/detecting-suspicious-powershell-execution"}