yara-rule-authoring
> Guides authoring of high-quality YARA-X detection rules for malware identification.
About
>
Guides authoring of high-quality YARA-X detection rules for malware identification.
Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions,
string selection, performance optimization, migration from legacy YARA, and false
positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting,
IOC, signature, crx module, dex module.
What it can do
- >
- Guides authoring of high-quality YARA-X detection rules for malware identification.
- Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions,
- string selection, performance optimization, migration from legacy YARA, and false
- positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting,
- IOC, signature, crx module, dex module.
Setup
- Install:
npx skills add trailofbits/skills --all - The skill auto-loads when relevant, or invoke it by name in your agent.
Prerequisites
A compatible AI coding agent (Claude Code, Cursor, etc.).
Use cases
Works with
Trust score — 9/10
Trail of Bits is a top-tier security research firm; their skills are professional-grade auditing and fuzzing playbooks used by their own engineers. Open source.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.