Scope the locality guard to the namespace

[rng1995]

Jira

Jira: SKILLSPECT-12
Deliverable #4: Scope the locality guard to the namespace

Summary

• Restrict the destructive/autonomy locality post-filter to the packaged agent_skills namespace.
• Keep the existing rule-name check as the second half of the rule identity.
• Add regression coverage for a user-supplied rule that intentionally reuses the built-in rule name.

Problem

SkillSpector compiles built-in and user-supplied YARA files into separate namespaces, but the locality guard introduced for agent_skill_destructive_autonomous_actions previously checked only match.rule.

Because YARA rule names need only be unique within a namespace, a user rule can legally use the same name with unrelated string identifiers and semantics. The built-in post-filter would then inspect that custom match, find no built-in destructive/autonomy identifiers, and silently discard a valid user-defined finding.

Implementation

• Define the packaged destructive-action namespace as agent_skills.
• Apply the locality filter only when both namespace and rule name identify the built-in rule.
• Leave all other namespaces on the normal finding path, including same-named user rules.

Security invariants

• The built-in cross-context false-positive suppression remains unchanged.
• Built-in local destructive/autonomy evidence still produces a HIGH finding.
• Built-in rm -rf / detection remains unconditionally blocking.
• User-supplied rules are no longer altered solely because their rule name collides with a built-in rule in another namespace.

User impact

Custom YARA rules retain their declared behavior even when their rule names collide with built-in rules in a different namespace. The packaged destructive-action guard continues to suppress only its intended cross-context false positives.

Validation

• 61 passed in tests/nodes/analyzers/test_static_yara.py.
• Added a regression proving built-in directory precedence is preserved even when a same-named user rule path sorts first.\n- The regression also proves the packaged distant-evidence match is locality-filtered while the user-namespaced match is reported.
• Existing regressions for distant built-in evidence, local destructive/autonomy evidence, and root deletion all pass.
• Ruff lint and format checks passed for both changed files.
• git diff --check passed.

Files changed

• src/skillspector/nodes/analyzers/static_yara.py
• tests/nodes/analyzers/test_static_yara.py