feat(yara): add agent skill abuse signatures

[debugactiveprocess]

Adds a new built-in YARA rule file focused on AI agent skill abuse patterns:

• credential exfiltration through commodity webhooks
• remote bootstrap execution
• hidden prompt injection instructions
• MCP/tool metadata poisoning
• destructive autonomous actions

[ailton345ai-star]

Ppp

[keshprad]

When I spoke to @sapph2c, she mentioned that this MR makes all pip installs get flagged as high critical issues.

@sapph2c Can you pls add your full feedback here? Or pls add commits on top of this MR to make those relevant fixes thanks

[debugactiveprocess]

This rule does not flag all pip install commands as high critical issues, the detection is specifically scoped to pip install operations that fetch packages directly from remote URLs or Git repositories over HTTP/HTTPS. The intention is to identify installations that bypass the normal package repository workflow and pull code directly from external sources:

pip install hxxps://example.com/package.whl
pip install git+hxxps://github.com/user/repo.git
pip install --upgrade hxxps://example.com/package.whl

[debugactiveprocess]

Updated the remote bootstrap YARA rule to remove generic curl|sh and PowerShell iex install patterns due to false-positive risk. Also tightened the Node fetch eval detection to require evaluating response text via .text(), and added regression tests for both positive and negative cases. Tks!

[ailton345ai-star]

Bm

[rng1995]

APPROVE — well-scoped, high-quality addition.

Correctness ✅

• All 5 rules compile cleanly and I ran each against the included fixtures: 5 positive + 4 negative cases all behave as asserted.
• The multi-indicator conditions (any of ($secret_*) and any of ($send_*) and any of ($collector_*), the $agent_context and any of ($inj_*) gating, the 2 of ($inj_*) fallback) are good design for keeping false positives low on documentation-heavy skill bundles.
• The negative tests are a particularly nice touch and correctly do not fire: common curl … | sh / irm … | iex installers, eval(fetch(...))/eval(await fetch(...)) without a .text() response read, and doc-only credential references.

Consistency ✅

• Meta schema (description/category/severity/confidence/reference), the category values (malware, hack_tool), and the stringified confidence all match the existing rule files and the static_yara node's _CATEGORY_MAP / _parse_meta expectations, so rule IDs and severities map correctly. SPDX header matches repo convention.

Security ✅

• Detection targets the stated abuse classes (webhook exfil, remote bootstrap, hidden prompt injection, MCP/tool metadata poisoning incl. zero-width/RTL bytes, destructive autonomous actions) without obvious bypass-by-construction. No ReDoS concern given YARA's non-backtracking regex engine.

Minor / optional (non-blocking):

• $long_base64 ([A-Za-z0-9+/]{120,}) gated behind a $schema_* key may occasionally fire on large/minified JSON manifests or embedded base64 assets. Appropriately gated — just flagging as a tuning watch-item.
• $pip_remote_install will also match legitimate pip install git+https://…; fine as a heuristic, just noting.
• The new file is missing a trailing newline.

Thanks for the thorough tests — approving.

[ailton345ai-star]

Pg