cowWhySo/permission-command-corpus

---
pretty_name: Permission Command Corpus
language:
- en
license: apache-2.0
task_categories:
- text-classification
task_ids:
- text-classification
size_categories:
- 10K<n<100K
configs:
- config_name: gold
data_files:
- split: train
path: gold/train.csv
- split: validation
path: gold/validation.csv
- split: test
path: gold/test.csv
- config_name: silver_weak_labels
data_files:
- split: raw
path: silver_weak_labels/raw.csv
- config_name: review_queue
data_files:
- split: raw
path: review_queue/raw.csv
---

# Permission Command Corpus

This dataset repo keeps three views of the command-safety corpus:

- **gold**: trusted rows used for training the primary command-permission classifier
- **silver_weak_labels**: mined weak-label rows from Sigma / LOLBAS / GTFOBins / Atomic Red Team / Falco that have been kept as useful but are not promoted to gold
- **review_queue**: unresolved or review-needed rows that should not be treated as trusted training data

## Primary intended use

This corpus is for local command-risk classification in front of an LLM or tool bridge.
The gold config should remain the only default source for the production classifier.
Silver and review configs are preserved for adjudication, augmentation, and auditability.

## Gold columns

- `text`
- `normalized_text`
- `actual_label`
- `surface_label`
- `obfuscation_label`
- `obfuscation_type`
- `risk_class`
- `shell_family`
- `source`
- `split`

## Silver / review columns

- `sample_id`
- `text`
- `normalized_text`
- `label`
- `surface_label`
- `obfuscation_label`
- `risk_class`
- `label_source`
- `source_family`
- `source_repo`
- `source_path`
- `source_title`
- `category`
- `attack_tags`
- `platform`
- `confidence`
- `needs_adjudication`
- `keep_for_training`
- `training_role`
- `adjudication_reason`
- `adjudication_model`
- `dataset_role`
- `promotion_status`
- `created_at`

## Important caveat

Do **not** merge the silver or review configs directly into the gold training split without adjudication.
The weak-label corpora are valuable, but they are not equivalent to trusted labels.