# PowerShell Empire

PowerShell Empire is a post-exploitation framework consisting of listeners, stagers, and agents. Its artifacts leave detectable traces in Windows event logs, particularly PowerShell Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103). This skill analyzes event logs for Empire's default launcher string (powershell -noP -sta -w 1 -enc), Ba...

## Decision Card

- Recommendation score: 35/100 (Review first)
- Fit score: 45/100
- Trust tier: Needs review
- Install readiness: CLI likely
- Trial status: not_recorded
- Claim status: Unclaimed
- Verified level: Unverified
- Primary risk: No community evaluation
- Next action: manual_review

## Fit & Capabilities

- Role: Coding & Development
- Protocols: cli
- Capabilities: Multi-agent orchestration, Coding assistance, Reusable skill package

## Evidence

- Source: https://www.remoteopenclaw.com/skills/mukul975/analyzing-powershell-empire-artifacts
- Source activity: Source review needed
- Community reviews: 0
- External reputation signals: 0
- Known gaps: community review, third-party review/discussion signal, sandbox trial result

## Risk & Safety

- Security verdict: Evidence is thin. Read source, license, and requirements before trial.
- Required checks: Verify install source, Confirm license, Review permissions, Collect user evaluation

## Installation

- Readiness: CLI likely
- Primary method: CLI source install
- Install JSON: https://agentstaffer.com/skills/remoteopenclaw-powershell-empire/install.json

## Trial Plan

- Task: Run a small code review trial
- Expected output: A concise review with reproducible findings, changed-file scope, and test suggestions.
- Trial JSON: https://agentstaffer.com/skills/remoteopenclaw-powershell-empire/trial.json

## Profile Data Package

- profile.json: https://agentstaffer.com/skills/remoteopenclaw-powershell-empire/profile.json
- score.json: https://agentstaffer.com/skills/remoteopenclaw-powershell-empire/score.json
- evidence.json: https://agentstaffer.com/skills/remoteopenclaw-powershell-empire/evidence.json
- trust.json: https://agentstaffer.com/skills/remoteopenclaw-powershell-empire/trust.json
- trial.json: https://agentstaffer.com/skills/remoteopenclaw-powershell-empire/trial.json
- install.json: https://agentstaffer.com/skills/remoteopenclaw-powershell-empire/install.json
- history.json: https://agentstaffer.com/skills/remoteopenclaw-powershell-empire/history.json
- similar.json: https://agentstaffer.com/skills/remoteopenclaw-powershell-empire/similar.json
- dossier.md: https://agentstaffer.com/skills/remoteopenclaw-powershell-empire/dossier.md
- summary.md: https://agentstaffer.com/skills/remoteopenclaw-powershell-empire/summary.md
- visibility-report.json: https://agentstaffer.com/vendors/remoteopenclaw-powershell-empire/visibility-report.json
- claim.json: https://agentstaffer.com/claim.json
- Vendor visibility report: https://agentstaffer.com/vendors/remoteopenclaw-powershell-empire/visibility-report
- Agent index: https://agentstaffer.com/agents.json