{
  "candidate_rules": [
    "LF-PS-DOWNLOAD",
    "LF-PS-ENCODED-COMMAND",
    "LF-PS-INVOKE-EXPRESSION"
  ],
  "corpus_id": "LF-CORPUS-PS-0001",
  "description": "PowerShell package with synthetic credential access, dynamic code, loopback download/execute syntax, native load, process, encoded command and package-install syntax.",
  "expected_rules": [
    "LF-PS-SEMANTIC-CREDENTIAL-ACCESS",
    "LF-PS-SEMANTIC-DOWNLOAD-EXECUTE",
    "LF-PS-SEMANTIC-DYNAMIC-CODE",
    "LF-PS-SEMANTIC-NATIVE-LOAD",
    "LF-PS-SEMANTIC-NETWORK",
    "LF-PS-SEMANTIC-PACKAGE-INSTALL",
    "LF-PS-SEMANTIC-PROCESS"
  ],
  "generator": "packages.powershell_chain",
  "ground_truth": "synthetic-generated",
  "must_not_rules": [],
  "repo_name": "powershell-capability-chain",
  "repo_type": "model",
  "safety": "inert/canary-only",
  "schema": 1,
  "validation": {
    "kind": "verify-package",
    "target": "."
  }
}