yara-rule-authoring agent skill by trailofbits
Guides authoring of YARA-X detection rules for malware identification, covering naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction.
At a glance
| Publisher | Trail of Bits Official |
|---|---|
| Repository | trailofbits/skills (83 listed skills) |
| Category | Security |
| License | CC-BY-SA-4.0 |
| Last commit | October 15, 2026 (repository) |
| SKILL.md | 441 lines, 3,456 words |
| Bundled files | 22 files, including references, scripts, assets or templates |
| Quality score | 86/100 · B Passes all seven graded checks |
| Security scan | Not scanned |
| README badge | Get the badges for this listing |
Before you install
Read from the skill's files at the directory's October 19, 2026 snapshot: what ships with it, what its code reads, and the terms it is published under.
- Bundled scripts: 5 script files (4 Python, 1 Shell). Your agent may run them, so read them first.
- License: CC-BY-SA-4.0, an open-source or open-content license.
Install yara-rule-authoring
The skills CLI works with Claude Code, Codex, Cursor and other agents; the other routes copy the folder by hand.
npx skills add https://github.com/trailofbits/skills/tree/main/plugins/yara-authoring/skills/yara-rule-authoringtmp="$(mktemp -d)"
git clone --depth 1 https://github.com/trailofbits/skills.git "$tmp/repo"
mkdir -p .claude/skills
cp -R "$tmp/repo/"plugins/yara-authoring/skills/yara-rule-authoring .claude/skills/
rm -rf "$tmp"python3 ~/.codex/skills/.system/skill-installer/scripts/install-skill-from-github.py \
--repo trailofbits/skills \
--path plugins/yara-authoring/skills/yara-rule-authoringtrailofbits/skills is third-party code. Read SKILL.md and any bundled scripts before you install it.
How the author describes it
Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.
From the description field of SKILL.md. Agents read this line to decide when to load the skill.
Sections in SKILL.md
- Core Principles
- When to Use
- When NOT to Use
- Platform Considerations
- macOS Malware Detection
- JavaScript Detection
- String Selection
- Choosing a String Type
- Condition Design
- all of vs any of
- Grouping by Confidence
- Modules vs Byte Checks
- Performance
- Before Writing: Is the Sample Packed?
- When Strings Fail, Pivot to Structure
- Debugging False Positives
Files in the skill folder
SKILL.mdagents/openai.yamlassets/trail-of-bits-mark.svgexamples/MAL_Mac_ProtonRAT_Jan25.yarexamples/MAL_NPM_SupplyChain_Jan25.yarexamples/MAL_Win_Remcos_Jan25.yarexamples/SUSP_CRX_SuspiciousPermissions.yarexamples/SUSP_JS_Obfuscation_Jan25.yarreferences/crx-module.mdreferences/dex-module.mdreferences/performance.mdreferences/strings.mdreferences/style-guide.mdreferences/testing.mdscripts/atom_analyzer.pyscripts/pyproject.tomlscripts/review.shscripts/test_yara_rules.pyscripts/uv.lockscripts/yara_lint.pyscripts/yara_rules.pyworkflows/rule-development.md
Suede Skill Check: 86/100 · B
Report snapshot · · graded-v2
The rubric totals 100 points; published scores are capped at 99. Security scan: not scanned.
Source revision: 5c99c03fb8a9. Report version 5c980a5b8e20. Badge URLs follow the latest listing; save the report to keep this version.
Download report · Request a fresh review
What to review next
- Boundary clause: 0 of 4 points. 4 when the description says when not to use the skill (“Not for …”, “Do not use …”, “Use … instead”).
- Example request: 0 of 3 points. 3 when the description quotes an example request (3–60 characters in quotation marks).
- Instruction depth: 4 of 7 points. 7 for a SKILL.md body of 500–3,000 words; 4 for 250–4,500; 1 for 100 or more.
Add declarations and bundled files when they describe the skill’s actual needs. Update the source, then request a fresh review with the changed commit or PR.
yara-rule-authoring passes the required frontmatter check and all seven graded checks, which cover the SKILL.md format, a declared license and a commit in the last year. Those checks earn 56 of the score’s points; the rest come from description quality, instruction depth, bundled files, maintenance and curated-list citations. How the score works.
See the checks and points
| Check | Result |
|---|---|
| Frontmatter parses and declares a name and a description | Pass |
| Name uses lowercase letters, digits and hyphens, 64 characters or fewer | Pass |
| Name matches the skill's folder name | Pass |
| Description is between 50 and 1,024 characters | Pass |
| Description says when an agent should use the skill | Pass |
| SKILL.md body is 500 lines or fewer | Pass |
| A license is declared in the frontmatter or the repository | Pass |
| Repository has a commit in the last 12 months | Pass |
| Score component | Points |
|---|---|
| Structural checks | 56 of 56 |
| Description length | 5 of 5 |
| Boundary clause | 0 of 4 |
| Example request | 0 of 3 |
| Instruction depth | 4 of 7 |
| Reference files | 3 of 3 |
| Bundled scripts | 2 of 2 |
| Recent maintenance | 9 of 9 |
| Curated-list citations | 7 of 7 |
| Tool permissions declared | 0 of 2 |
| Compatibility declared | 0 of 2 |
Two badges for yara-rule-authoring
Choose the numeric badge, the letter badge, or both. Each links to this skill’s Suede listing; either valid linked badge can qualify for the feature offer.
[](https://skills.suedeai.ai/directory/trailofbits/skills/yara-rule-authoring/)
[](https://skills.suedeai.ai/directory/trailofbits/skills/yara-rule-authoring/)<a href="https://skills.suedeai.ai/directory/trailofbits/skills/yara-rule-authoring/"><img src="https://skills.suedeai.ai/directory/trailofbits/skills/yara-rule-authoring/score.svg" alt="Suede Skill Check: 86/100" width="160" height="175"></a>
<a href="https://skills.suedeai.ai/directory/trailofbits/skills/yara-rule-authoring/"><img src="https://skills.suedeai.ai/directory/trailofbits/skills/yara-rule-authoring/badge.svg" alt="Suede Skill Check: Grade B" width="160" height="175"></a>Suede Certified on the shield refers to this published structural quality check. Security scan: not scanned. Read the methodology.
Limited-time feature offer: display either the numeric or letter badge in your repository or skill README (both also qualify), then request badge verification. Eligible skills scoring 80–99 can receive a featured placement after Suede verifies at least one valid badge linked to the skill’s listing. Suede has not announced an end date.
Where this skill is cited
trailofbits/skills appears in 4 curated lists: BehiSecc/awesome-claude-skills, heilcheng/awesome-agent-skills, hesreallyhim/awesome-claude-code, travisvn/awesome-claude-skills.