reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/malware-analysis-claude-skills/tests/extract_rules.py

@@ -0,0 +1,23 @@
+#!/usr/bin/env python3
+"""Extract fenced Sigma YAML blocks from a Markdown SKILL file to files.
+
+A block counts as Sigma if it contains both 'detection:' and 'logsource:'.
+Placeholder rules (id: xxxxxxxx...) are skipped so `sigma check` only sees
+real, validatable content.
+
+Usage: python3 extract_rules.py <SKILL.md> <out-prefix>   # -> <prefix>1.yml, ...
+"""
+import re
+import sys
+
+md, prefix = sys.argv[1], sys.argv[2]
+text = open(md, encoding="utf-8").read()
+blocks = re.findall(r"```ya?ml\n(.*?)```", text, re.S)
+n = 0
+for b in blocks:
+    if "detection:" in b and "logsource:" in b:
+        if not re.search(r"id:\s*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}", b):
+            continue  # skip the structure-template block; keep only rules with a real UUID
+        n += 1
+        open(f"{prefix}{n}.yml", "w").write(b)
+print(f"extracted {n} sigma rule(s)")