Datasets:

FINAL-Bench
/

Obfuscated-Shell-Gate

license: cc-by-4.0
task_categories:
  - text-classification
language:
  - en
tags:
  - security
  - shell
  - obfuscation
  - agent-safety
  - bash
size_categories:
  - n<1K
configs:
  - config_name: default
    data_files:
      - split: dev
        path: data/dev.jsonl

Obfuscated-Shell Gate Benchmark (Bash, dev)

A benchmark for safety gates and coding agents: decide ALLOW / ASK / DENY on a single bash command whose surface form may be obfuscated. Each risky command is paired with a benign command carrying the same obfuscation surface, so a gate is scored on reading the decoded intent, not on spotting that something looks encoded.

What is inside

222 bash commands, 103 risky and 119 benign.
17 intent families: b64_data, cred_read, data_exfil, destructive, disable_logging, download_exec, eval_legit, heredoc_config, ifs_parse, persistence, pipeline_jq, printf_fmt, privesc_fetch, readonly_ops, reverse_shell, tr_text, var_build.
13 surface forms including plain: b64_chunked, b64_pipe, backslash_break, chain_ifs_b64, chain_rev_b64, hex_pipe, ifs_split, none, octal_printf, quote_break, rev_pipe, rot13_pipe, var_concat.
Every row is verified in real bash: encoded rows decode back to their plain canonical form, and rewritten rows parse to the same argv. The verified field records which check passed. No payload is ever executed.

Safety of the data

Every network destination is an unresolvable .invalid host (RFC 6761). Destructive and credential examples target a sandbox path, never a real system path. The set exercises detection of a pattern; it is not runnable malware.

Fields

id, seed_id, family, is_risky, label (ALLOW/ASK/DENY), shell, command (the possibly obfuscated form), canonical (plain equivalent), transform, transform_chain, verified.

Using it

from datasets import load_dataset
ds = load_dataset("FINAL-Bench/Obfuscated-Shell-Gate", split="dev")

Score your gate's verdict against label. Report risky recall and benign false-block rate separately; a single accuracy number hides the trade-off that this set is built to expose.

Reference baselines (dev)

baseline	accuracy	risky recall	benign false-block
deny-everything-obfuscated	0.47	0.92	0.92
naive keyword match	0.47	0.61	0.65

Both surface baselines score at chance level, which is the intended property: the benign-obfuscated pairs make surface matching ineffective.

Held-out test

A private held-out split of comparable size is kept off the hub by design, so it stays usable as a true test rather than becoming training data.

Citation

VIDRAFT / FINAL-Bench, Obfuscated-Shell Gate Benchmark, 2026.