Skip to main content
Back to registry

yara-rule-authoring

trailofbits/skills

Write detection rules that catch malware without drowning in false positives.

Installs558
Install command
npx skills add https://github.com/trailofbits/skills --skill yara-rule-authoring
Security audits
Gen Agent Trust HubPASS
SocketPASS
SnykPASS
About this skill
Write detection rules that catch malware without drowning in false positives. This skill targets YARA-X , the Rust-based successor to legacy YARA. YARA-X powers VirusTotal's production systems and is the recommended implementation. See Migrating from Legacy YARA if you have existing rules. Strings must generate good atoms — YARA extracts 4-byte subsequences for fast matching. Strings with repeated bytes, common sequences, or under 4 bytes force slow bytecode verification on too many files. Target specific families, not categories — "Detects ransomware" catches everything and nothing. "Detects LockBit 3.0 configuration extraction routine" catches what you want.

Source description provided by the upstream skill listing. Community reviews and install context appear in the sections below.

Community Reviews

Latest reviews

Sign in to review

No community reviews yet. Be the first to review.

Browse this skill in context
FAQ
What does yara-rule-authoring do?

Write detection rules that catch malware without drowning in false positives.

Is yara-rule-authoring good?

yara-rule-authoring does not have approved reviews yet, so SkillJury cannot publish a community verdict.

What agent does yara-rule-authoring work with?

yara-rule-authoring currently lists compatibility with codex, gemini-cli, opencode, cursor, github-copilot, claude-code.

What are alternatives to yara-rule-authoring?

Skills in the same category include telegram-bot-builder, flutter-app-size, sharp-edges, iterative-retrieval.

How do I install yara-rule-authoring?

npx skills add https://github.com/trailofbits/skills --skill yara-rule-authoring

Related skills

More from trailofbits/skills

Related skills

Alternatives in Software Engineering