# Migration Helper Format

> Take a source SIEM rule and format its content for readability, then insert it into a YARA-L rule template.

- Skill: `googlecloudplatform/migration-helper-format` (Agent Skill)
- Install (CLI): `npx skillmds@latest add googlecloudplatform/migration-helper-format`
- Raw SKILL.md: https://api.skillmd.com/api/skills/googlecloudplatform/migration-helper-format/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: GoogleCloudPlatform (https://skillmd.com/u/googlecloudplatform)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/googlecloudplatform/migration-helper-format

---


# Format SIEM Rule inside Template

## Description
Formats a source rule from a legacy SIEM and inserts it into a specified YARA-L template file.

## When to Use This Skill
- Use this when formatting a legacy SIEM rule and placing it into the `SOURCE RULE` metadata section of an initialized YARA-L template file.
- Triggered by `/migration_helper_format <migrating_rule_path> <new_rule_name>` (where `<new_rule_name>` points to the target YARA-L file, i.e., `rules/<new_rule_name>/<new_rule_name>.yaral`).

## Instructions
Your task is to take the rule content provided in `<migrating_rule_path>` and insert it into the template structure of the target rule file `<new_rule_name>` (usually `rules/<new_rule_name>/<new_rule_name>.yaral`).

### Constraints & Steps:
1. **Content Integrity:** You are strictly forbidden from shortening, trimming, or modifying the logic/code within the source rule. Every character of the original rule logic must be fully preserved.
2. **Formatting:** Improve the indentation and spacing of the source rule to achieve maximum readability before insertion.
3. **Placement:** Locate the placeholder `<original formated source rule>` inside the target rule file and replace it with the newly formatted source rule content.
4. **Error Handling:** If the input in the source rule file appears truncated, incomplete, or corrupted, stop immediately and alert the user.
5. **Output:** Output the final merged result as a single code block, and write it back to the target rule file.