Yara Rule Authoring

Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, thr...

Overview

Yara Rule Authoring is a SKILL.md-based agent skill sourced from trailofbits/skills. It is categorized under security and is listed for Claude Code, Claude. The source description focuses on: Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive ... AIToolly summarizes this page as a directory entry rather than copying the full third-party skill content, so users can evaluate the source, compatibility, and practical fit before installing it.

Use Cases

Evaluate Yara Rule Authoring before adding it to an AI agent workflow.
Use Yara Rule Authoring as a starting point for repeatable security tasks.
Compare Yara Rule Authoring with related skills from skills and other GitHub repositories.

Install Notes

# Review source first
open https://github.com/trailofbits/skills/blob/main/plugins/yara-authoring/skills/yara-rule-authoring/SKILL.md

Copy or clone the skill folder into your agent skills directory after reviewing its instructions and scripts.

Security Notes

Review the source SKILL.md, referenced scripts, permissions, and external services before installing Yara Rule Authoring. Treat third-party skills like code dependencies, especially when they can read files, call APIs, or run commands.

Related Skills

Security And Hardening

addyosmani/agent-skills

Security

Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when personal data or privacy compliance (GDPR, CCPA) is involved.

typescriptjavascript
91,023 StarsMIT

Constraint Driven Development

addyosmani/agent-skills

Security

Establishes a project's quality bar as a written contract and stops agents quietly lowering it. Interviews the user on which dimensions matter, supplies sane default thresholds when they have no number in mind, records everything in CONSTRAINTS.md, and watches the diff for a weakened bar — new @ts-ignore or eslint-d...

CodexClaude
pythonsecurity
91,023 StarsMIT

Trailmark Summary

trailofbits/skills

Security

Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs a quick structural overview. Triggers: trailmark summary, code summary, structural overview.

Claude CodeClaude
pythonsecurity
6,924 StarsSource linked

Trailmark Structural

trailofbits/skills

Security

Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack surface, and version-gated Trailmark 0.4+/0.5+ data such as proxy counts, subgraph edges, type/reference summaries, and entrypoint attributes. Use when vivis...

Claude CodeClaude
pythonsecurity
6,924 StarsSource linked

Mermaid To Proverif

trailofbits/skills

Security

Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a ProVerif model, formally verifying a protocol, converting a Mermaid diagram to ProVerif, verifying protocol security properties (secrecy, authentication, forward secrecy)...

Claude CodeClaude
securityresearch
6,924 StarsSource linked

Sarif Parsing

trailofbits/skills

Security

Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SARIF data. Does NO...

Claude CodeClaude
pythonsecurity
6,924 StarsSource linked