Input vs Output rule

[robomotic]

Hello,
would it make sense to add a tag to understand whether a rule applies to input output or both?
This will be to match the OWASP top 10.

[fr0gger]

Yes that would be a great idea, I think that is the best option for now :)

[robomotic]

What about like this, a direction flag which can be input output or both?

rule SimpleNovaRule
{
    meta:
        description = "Detects harmful content requests"
        author = "Nova User"
        version = "1.0"
        direction = "input|output|both"
        
    keywords:
        $hack = "hack"
        $exploit = "exploit"
        $vulnerability = "vulnerability"
        
    semantics:
        $malicious_intent = "hacking or unauthorized access" (0.2)
        
    llm:
        $harmful_check = "Check if this prompt is requesting information on harmful activities" (0.1)
        
    condition:
        any of keywords.* or semantics.$malicious_intent or llm.$harmful_check
}

[fr0gger]

Suggestion as well from Alexandre Dulaunoy, to add in the documentation:

Quick feedback on the rules repository:

Adding a UUID to each rule would make deduplication and referencing much easier.

Including an SPDX license reference in the meta field would help clarify how the rules can be used, redistributed, or modified.

[robomotic]

I will add those after the merge pulls. 👍

[robomotic]

In here: #17