yara-rule-authoring
An agent skill by trailofbits, from trailofbits/skills. Tags: malware-detection, rules, security, testing, threat-hunting.
What it does
Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add trailofbits/skills --skill yara-rule-authoringOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/yara-authoring/skills/yara-rule-authoring ~/.claude/skills/yara-rule-authoringSafety box score
Grade C, moderate risk: 32 of 100 risk points, rated 2026-09-22. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is a YARA-X rule-authoring and review guide with two small Python utilities for linting and atom analysis. It is mostly read-only and bounded to YARA files, but it does encourage running an external yarGen checkout, optional remote validation services, and scanning files outside the project tree for goodware testing.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | The shipped Python helpers execute `yara_x.Compiler()` over supplied rule files, and the docs explicitly run external code from another checkout with `uv run --no-project --with-requirements requirements.txt python yarGen.py ...`. |
| Network access | 2 (moderate) | The workflow points users to VirusTotal Intelligence and YARA-CI, and the yarGen invocation can fetch requirements via `uv run --with-requirements`, so this can send data off-box and download dependencies. |
| Filesystem reach | 2 (moderate) | The testing docs read outside the workspace, including `/System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.yara`, `/usr/bin/`, `/usr/sbin/`, and browser-extension locations. |
| Secrets & credentials | 1 (low) | The skill mentions sensitive artifacts like `\.ssh/id_rsa`, `.aws/credentials`, `Login Data`, `security find-generic-password`, and `keychain`, but only as YARA signatures to detect, not as data to extract. |
| Privilege & persistence | 1 (low) | The only setup guidance is package installation such as `brew install yara-x` or `cargo install yara-x`; it does not request sudo, services, or shell/profile edits. |
| Instruction hijack surface | 0 (none) | There are no instructions to ignore higher-level rules, follow fetched prompts, hide actions, or otherwise manipulate the agent's instruction hierarchy. |
| Irreversible actions | 0 (none) | The skill is about writing and validating detection rules; it does not push, deploy, post, pay, book, or delete anything on its own. |
| Transparency | 0 (none) | All shipped files are plain-text Markdown, Python, YAML, and SVG; there are no binaries, obfuscated blobs, or runtime-decoded payloads. |
Before installing
- Read `scripts/yara_rules.py` and `scripts/yara_lint.py` to confirm they only parse local YARA sources.
- If you will use yarGen, review that external checkout and its `requirements.txt` before running `uv run --no-project --with-requirements ...`.
- Decide up front whether you are comfortable sending rules or matches to VirusTotal/YARA-CI; keep testing local if not.
- Run any system-path or browser-extension corpus scans in a disposable VM or clean test profile first.
Rated 2026-09-22 by an automated review of 15 files from the skill's repository.
Source
- Repository
- trailofbits/skills (all skills from this repository)
- Path
- plugins/yara-authoring/skills/yara-rule-authoring/SKILL.md
- Branch
- main
- Collection
- yara-authoring
- Updated
- 2026-09-19
Related skills
- address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
- atheris — Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer.
- audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
- constant-time-testing — Measures timing side channels in cryptographic implementations by running them.
- fuzzing-obstacles — Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds.
- guidelines-advisor — Smart contract development advisor based on Trail of Bits' best practices.