Fixes #859.

Impact: silent-wrong-result

Who reaches this: any skillspector scan (CLI or MCP scan_skill) of a skill that bundles a Python script, through the built-in YARA rules (static_yara, YR1).

Triggered when: a script walks a directory with os.walk, encrypts each file and writes it back, with the calls on separate lines (the normal way to write it) and no ransom note. $walk_encrypt and $mass_overwrite have no dot-all flag, so they need os.walk( on the same line as the encrypt/open call.

What the user observes: a script that encrypts every file under ~ in place scans as score: 14, recommendation: SAFE with no YARA finding. With this change it reports YR1 HIGH ransomware_behavior_multiline and score: 34, recommendation: CAUTION.

Fix

ransomware_behavior is unchanged. A new rule, ransomware_behavior_multiline (HIGH, confidence 0.6), fires when os.walk(, an .encrypt(/.cipher( call and a binary-write open() (wb, w+b, r+b, rb+) all fall within 1 KiB of the same walk, before or after it. The "before" side covers a helper function defined above the loop. The rule stays quiet when ransomware_behavior already matches, so single-line cases still get one CRITICAL finding.

A signature cannot prove that the write replaces the walked file. That is why the rule reports at reduced confidence, the same way reverse_shell_multiline does. The known false positive is a backup tool that walks a tree and writes encrypted copies to new files. That case now gets HIGH/0.6 instead of nothing.

The rule adds no new compiler warnings, and no file in this repository matches it.

Tests

In TestBuiltInRansomwareRule:

• three positives: overwrite inside the walk loop, a helper defined before the walk, and an in-place r+b write. Each must produce exactly one YR1 HIGH/0.6 ransomware_behavior_multiline finding and no ransomware_behavior finding.
• four negatives: walk plus an unrelated download, walk plus read-only hashing, single-file encryption with no walk, and a walk more than 1 KiB from the encrypt/write.
• a single-line case that still reports only the CRITICAL ransomware_behavior.

Negative control: reverted malware.yar.b64 to main and kept the new test:

FAILED tests/nodes/analyzers/test_static_yara.py::TestBuiltInRansomwareRule::test_multiline_walk_encrypt_overwrite_without_note_is_detected[overwrite-in-walk-loop]
FAILED tests/nodes/analyzers/test_static_yara.py::TestBuiltInRansomwareRule::test_multiline_walk_encrypt_overwrite_without_note_is_detected[helper-defined-before-walk]
FAILED tests/nodes/analyzers/test_static_yara.py::TestBuiltInRansomwareRule::test_multiline_walk_encrypt_overwrite_without_note_is_detected[read-write-in-place]
3 failed

With the fix: 3 passed. tests/nodes/analyzers/test_static_yara.py and tests/integration/test_ransomware_rule.py give 361 passed. ruff check and ruff format --check are clean.

#752 also re-encodes malware.yar.b64 (in info_stealer), so whichever PR lands second will need to decode and re-encode.

Signed-off-by: Udaya Tejas udayatejas2004@gmail.com