`vulkro-sf rules`

Writes, tests and manages your own YAML detection rules, and inspects the rule packs and playbooks that ship with the binary.

vulkro-sf rules new my-debug-rule            # scaffold .vulkro-sf/rules/my-debug-rule.yaml
vulkro-sf rules validate .vulkro-sf/rules/my-debug-rule.yaml
vulkro-sf rules list

vulkro-sf scan loads custom rules automatically from .vulkro-sf/rules/ in the project (takes precedence) and ~/.vulkro/rules/. Set VULKRO_SF_CUSTOM_RULES_DIR to load only one folder, for example to test a rule pack in CI.

Subcommand	What it does
`new <id>`	Scaffold a working `apex-ast` rule (it flags `System.debug`). `--force` overwrites.
`validate <file>`	Parse the rule and compile its match block (regex, XML or Apex AST).
`list [PATH]`	List every custom rule the loader sees, in load order. Files that fail to parse are shown with a warning.
`marketplace list\|install\|uninstall\|update`	Install community rules from the signed bundle in the binary. The hash is checked before install; nothing is fetched from the network.
`pack list\|show`	Inspect the bundled detector packs (NPSP, Veeva, Vlocity, Certinia).
`playbook list\|show <domain> <playbook>`	Inspect the bundled domain packs and their playbooks, such as `healthcare phi-exposure-review`.
`appexchange [--validate]`	Print or check the mapping from findings to AgentExchange (formerly AppExchange) Security Review checklist sections.
`import-checkmarx <xml>`	Translate an Apex query export from another scanner into a rule file. Only source and sink endpoints carry over.
`import-semgrep <yaml>`	Translate an Apex rule file from another scanner. Compound patterns are skipped with a warning.

The importers write to .vulkro-sf/rules/ next to the input unless you pass --output, and every translated rule is checked to load before it is written. Review the output before you rely on it.

Rules are data only: they cannot run commands, touch files or use the network.

Exit codes

Code	Meaning
`0`	Success.
`2`	Error (bad path, malformed or uncompilable rule, unknown id).

Exit codes​

Exit codes