Struct Rule 

pub struct Rule {

    pub id: String,
    pub category: ThreatCategory,
    pub severity: Severity,
    pub confidence: f32,
    pub condition: RuleCondition,
    pub action: RecommendedAction,
    pub reason: String,
    pub shield: Option<ShieldHint>,
    pub enabled: bool,
    pub tags: Vec<String>,
    pub promptintel_threats: Vec<String>,
    pub requires_code_artifact: bool,
    pub downgrade_when_confirmation_gate: bool,
    pub downgrade_when_documentation_context: bool,
}

A security detection rule

Rules define security patterns to detect in skill documents. Each rule specifies a condition to match, the threat category, severity level, and recommended action when matched.

Rules are typically defined in YAML format and loaded by the super::RuleEngine.

Fields

id: String

Unique rule identifier

category: ThreatCategory

Threat category

severity: Severity

Severity level

confidence: f32

Confidence score (0.0 - 1.0)

condition: RuleCondition

Condition that triggers the rule

action: RecommendedAction

Recommended action

reason: String

Human-readable reason

shield: Option<ShieldHint>

Shield policy hint

enabled: bool

Whether the rule is enabled

tags: Vec<String>

Tags for filtering

promptintel_threats: Vec<String>

Optional list of upstream PromptIntel threat names this rule covers (e.g. ["Jailbreak", "Hidden instruction in code or comments"]). Used by the promptintel coverage command to build a per-threat audit table; left empty for rules that do not target prompt-layer attacks. Validation against the canonical taxonomy happens in the CLI, not at parse time, so an upstream rename does not brick rule loading.

requires_code_artifact: bool

When true, a regex match in the SKILL.md prose body that is NOT corroborated by an occurrence inside any markdown code block is downgraded from the rule’s natural action / signal-class to RequireApproval / ReviewSignal. Used for vocabulary-only rules (SKILL_PAYMENT_ACCESS, SKILL_TOKEN_SCAM, …) that legitimately fire on documentation or coaching skills which only DESCRIBE the pattern they detect. Cross-LLM triage on a 4000-skill VT-clean corpus confirmed prose-only matches drive ~30-50 FPs per affected rule.

Defaults to false — opt-in per rule, never global. The downgrade applies AFTER the regex matched; matches inside code blocks (or in any artifact whose MatchTarget is CodeBlock / ReferencedFile) keep full strength.

downgrade_when_confirmation_gate: bool

When true, a finding is downgraded if the surrounding document contains explicit human-in-the-loop confirmation gate markers (e.g. confirmation_token, “user types YES”, “two-step gate”, “propose → user”). Used for autonomy / payment / deferred-execution rules whose risk model assumes no human gate. Cross-LLM triage on a 4000-skill VT-clean corpus showed okx-trading-style skills with strict propose→confirm workflows trip these rules even though the gate is exactly the safety control the rule was designed to require.

Defaults to false. Marker list lives in compiled::CONFIRMATION_GATE_MARKERS and is intentionally case-insensitive so authors don’t have to predict the exact phrasing.

downgrade_when_documentation_context: bool

When true, a finding is downgraded if the document declares itself as an educational / detection / anti-pattern catalogue (e.g. ## What it checks, ## Anti-patterns, “this skill detects”, “examples of bad code”). Used for vocabulary rules whose patterns appear in security scanners that document the very behaviours they detect.

Defaults to false. Marker list lives in compiled::DOCUMENTATION_CONTEXT_MARKERS.

Trait Implementations

impl Clone for Rule

fn clone(&self) -> Rule

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Rule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Rule

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Rule

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.