AI-agent skill / MCP-server malware lane

malcontent already covers the package/script supply chain well — rules/exfil/npm.yara flags postinstall fetchers, and rules/malware/supplychain/ has entries like litellm.yara. AI-agent skills and MCP servers are a newer slice of that same surface: they ship as npm/pip packages (often with install hooks) or as skill bundles carrying shell/Python/JS, so the malicious behavior — credential exfil, droppers, install-time fetchers, rug-pulls — lands squarely in the categories malcontent already scans.

To be clear on scope: I mean the code-behavior layer YARA detects, not the natural-language prompt-injection layer (that's a different problem and out of model here).

I maintain ATR (open MIT). A 96K-skill wild scan surfaced confirmed-malicious agent skills in this space, and the behaviors map onto your existing lanes (credential, exfil, exec/script, malware/supplychain). SECURITY.md invites coverage-gap issues, so: would a rule set for agent-skill + MCP-server malware be in scope? Happy to share the finding patterns and draft rules in YARA following your rules/ conventions (severity tag, meta/filetypes, string sets).

(Disclosure: I'm the ATR maintainer.)

Read SECURITY.md and compare the existing patterns in rules/exfil/npm.yara with entries under rules/malware/supplychain/, including litellm.yara. Review the proposed behavior scope for agent skills and MCP servers, then draft rules following the repository's YARA conventions, including severity, meta, filetypes, and string sets. Done means the coverage gap is resolved with accepted rules focused on code behavior rather than prompt injection.