yara-rule-authoring
An agent skill by trailofbits, from trailofbits/skills. Tags: malware-detection, rules, security, testing, threat-hunting.
What it does
Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add trailofbits/skills --skill yara-rule-authoringOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/yara-authoring/skills/yara-rule-authoring ~/.claude/skills/yara-rule-authoringSafety box score
Not rated yet. A safety box score grades what a skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. Anyone can request one from this page; it is saved for everyone. How the score works.
Source
- Repository
- trailofbits/skills (all skills from this repository)
- Path
- plugins/yara-authoring/skills/yara-rule-authoring/SKILL.md
- Branch
- main
- Collection
- yara-authoring
- Updated
- 2026-09-19
Related skills
- address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
- atheris — Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer.
- audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
- constant-time-testing — Measures timing side channels in cryptographic implementations by running them.
- fuzzing-obstacles — Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds.
- guidelines-advisor — Smart contract development advisor based on Trail of Bits' best practices.