The Project has the rules under /sources. The bundled core rules are under /sources/core and the additional rules are under /sources/owasp.

I suggest that we create a /source/additional-skills directory and include owasp and other skills like the ones proposed in #46 .