Automated security-centric refactoring of PowerShell commands using large language models: A Python-based framework for cross-language automation

The integration of Large Language Models (LLMs) into software engineering workflows has demonstrated significant potential for automating code refactoring across programming languages. However, cross-language refactoring—particularly between high-level orchestration languages (Python) and shell scripting environments (PowerShell)—presents unique security and semantic challenges. This paper presents a novel framework for LLM-refactored Python-based PowerShell command generation that addresses critical security vulnerabilities inherent in automated code translation. We evaluate the framework using a curated dataset of 8886 labeled examples (yielding 7,719 unique, deduplicated patterns via AST-based hashing and semantic filtering) mapped across ten MITRE ATT&CK categories. Using 5-fold stratified cross-validation , our analysis reveals that 21.95% of PowerShell commands contain high-risk security patterns, with Invoke-Expression ( 8.3% ), DownloadString ( 5.8% ), and execution policy bypasses ( 2.5% ) being most prevalent. We demonstrate that Retrieval-Augmented Generation (RAG) techniques reduce vulnerability introduction rates by 57.9% relative to standard GPT-4o (absolute reduction: 22.3 pp; p < 0.001 , McNemar test) and outperform security-aware prompting ( 81.5% vs. 54.3% security compliance). Comprehensive comparisons against rule-based sanitizers, prior frameworks, and larger models (CodeLlama-34B, DeepSeek-Coder-V2-Lite-16B) show that our 7B-parameter framework achieves superior security outcomes with significantly reduced computational requirements. We address prompt injection risks through defense-in-depth strategies, including semantic intent classification, Unicode normalization, randomized delimiter spotlighting, and multi-turn stateful risk tracking. Furthermore, we subject the framework to a rigorous adversarial evaluation utilizing Atomic Red Team, PyRIT, and Garak benchmarks, achieving a 100% Detection Rate (DR) and reducing the Attack Success Rate (ASR) to 0% across 76 complex adversarial scenarios. We provide complete dataset and code artifacts for reproducibility ( https://github.com/tamerelserwy-research/Secure-LargeLanguageModel-PS-Refactoring ), following the Reproducibility Maturity Model (RMM) guidelines.