Since perl itself is a scripting language, and allows code to be eval'ed,
I can't see why we need to go the whole hog and implement another
turing-complete scripting language in perl.
Let's go back to *why* this would be useful.  As far as I can see, you're
proposing this to deal with multi-match rules.  There's already a tracker
in the bug DB for these, with a proposed implementation.
I think this might have stalled due to shortcomings in the existnig
proposal, so I've just added my own thoughts on how to implement them. ;)
Comments on the proposed system would be welcome folks.... reply to the

from localhost (localhost [127.0.0.1])
	by phobos.labs.netnoteinc.com (Postfix) with ESMTP id 66C2F440C9
	for <jm@localhost>; Tue,  6 Aug 2002 13:32:01 -0400 (EDT)
from phobos [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Tue, 06 Aug 2002 18:32:01 +0100 (IST)
from outgoing.securityfocus.com (outgoing2.securityfocus.com
    [66.38.151.26]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id
    g76HSEk12325 for <legit-lists-secfocus@jmason.org>; Tue, 6 Aug 2002
    18:28:14 +0100
from lists.securityfocus.com (lists.securityfocus.com
    [66.38.151.19]) by outgoing.securityfocus.com (Postfix) with QMQP id
    BE83F8F30B; Tue,  6 Aug 2002 10:07:50 -0600 (MDT)
contact focus-virus-help@securityfocus.com; run by ezmlm
(qmail 13368 invoked from network); 6 Aug 2002 16:02:43 -0000
"'Thor Larholm'" <Thor@jubii.dk>, <nick@virus-l.demon.co.uk>,
	<FOCUS-VIRUS@securityfocus.com>
From focus-virus-return-1680-legit-lists-secfocus=jmason.org@securityfocus.com  Tue Aug  6 18:32:06 2002

I guess there's no easy way to avoid this. In order to proactively
protect endusers they'll need to put such code (or part of it) into
their defs. Since antivirus products still gets smarter and smarter and
heuristics are getting better and better the odds aginst not running
into false positives are poor. Some products will woe plenty of these
some are better to avoid the madness (!). I'll leave you to do the test.
Consider that corporate and endusers are most likely using Microsoft
software without updating as they should. AV-software is now trying to
protect these poor souls adding proxy functionality to catch e.g.
malicious content in HTML based e-mails and for a good reason. Looking
at http://www.pivx.com/larholm/unpatched/ says it all!  ;-)
> Fra: Thor Larholm [mailto:Thor@jubii.dk]
> What I find even more annoying is the horde of false
> positives that antivirus software constantly yaps one about
> each time one sends some demonstratory POC to a mailinglist
> only to have several witless antivirus vendors add ones POC
> to their virus library, yielding tons of "Quarantined"
> replies on a daily basis without any added level of security
> to the enduser whatsoever since any reallife exploitation
> would yield a completely different signature, thus defeating
> *phew* That could have used some punctuation. :)