ClonePeek v0.2.2 — measured synthetic evaluation and PowerShell detection

Fixed detection gap

A new regression reproduced a missed PowerShell fetch/execute form: iex (iwr URL).Content or Invoke-Expression (Invoke-WebRequest -Uri URL).Content previously had only medium review urgency. These expressions now classify critical. Static fixtures use .invalid URLs and never execute remote commands.

Measured labeled fixture evaluation

• 46 version-controlled, independently rationalized synthetic cases (up from 12), spanning 7 execution-surface rules and benign/suspicious Windows PowerShell examples.
• Threshold high: TP=15, FP=3, FN=2, TN=26. Fixture-only precision=83.3%, recall=88.2%.
• Rule-by-rule detection confusion, support, diagnostic Wilson intervals and safe nulls for unmeasurable statistics.
• Existing false positives (harmless folder-open tasks) and false negatives (indirect scripts) are retained and clearly documented.

These hand-authored scores must not be portrayed as real-world malware detection accuracy. ClonePeek remains an offline heuristic execution surface inventory, not a sandbox.

Verification

34 tests pass locally, and 12 PR GitHub checks pass across Ubuntu/macOS/Windows with Python 3.10 and Python 3.13. See docs/EVALUATION.md for reproducibility and limits.