Tessl • The management layer for AI agent skills

SkillPublic

reverser-yara-hunting

YARA rule authoring + hunting — `condition:` syntax, hex patterns with wildcards, `for`/`any of them`, PE module, ELF module, hash module, math module. Build per-family signatures, hunt at scale via VT/MalwareBazaar/Hybrid Analysis. Avoid common pitfalls (collisions, slow rules, regex traps).

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/reverser/yara-hunting/SKILL.md

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an efficient, code-heavy reference with concrete rules, commands, and a valuable pitfalls table, plus a mass-hunt workflow that includes explicit validation checkpoints. Remaining gaps are minor: a few placeholder or comment-only blocks, no executable commands for the validation steps, and an unlinked references section.

Suggestions

Add concrete validation commands to the workflow's test steps (e.g. `yara rule.yar sample.exe` and `yara -r rules/ clean_corpus/`) so the must-match/must-NOT-match checkpoints are executable.

Replace the comment-only VirusTotal Retrohunt block with an actual submission step or a link to the Retrohunt UI, and flesh out `hash.sha256(...)` placeholders.

Turn the terminal "References" section into actionable links/paths, and consider moving detailed module syntax (PE/ELF/hash/math) into a `references/` file.

Dimension	Reasoning	Score
Conciseness	The body is lean and code-first — a complete annotated rule, a compact condition-tools snippet, a dense pitfalls table, and terse tool lists. Minor trimmable padding remains: editorial asides ("the canonical YARA author of our era") and a comment-only VT Retrohunt block.	4 / 5
Actionability	Mostly executable guidance: full YARA rules, a concrete MalwareBazaar `curl` command, and local scan commands (`yara -r rules/ /samples/`, `capa`). Minor gaps: the Retrohunt section is comments only, `hash.sha256(0, filesize) == "..."` is a placeholder, and the workflow's test steps lack concrete commands.	4 / 5
Workflow Clarity	The mass-hunt workflow is clearly sequenced with explicit validation checkpoints — "must match" the known sample and "must NOT match" clean and cross-family corpora — plus an iterate step. Minor gaps: the validation steps don't include runnable commands, and step 1 references a `reverser/malware-triage` skill not present in this bundle.	4 / 5
Progressive Disclosure	A single self-contained file with no bundle directories; sections are well-organized and headers make navigation easy at this size. Minor gaps: detailed module/condition syntax could live in a reference file, and the terminal "References" section lists unlinked titles rather than actionable paths or URLs.	4 / 5
	Total	16 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and comprehensive about what the skill does, with a distinct niche and good trigger keywords. Its main weakness is the absence of an explicit "Use when..." trigger clause and reliance on the abbreviation "VT" instead of the natural term "VirusTotal".

Suggestions

Append an explicit trigger clause, e.g. "Use when writing or testing YARA rules, building malware family signatures, or hunting across VirusTotal/MalwareBazaar corpora."

Spell out "VirusTotal" (or add "VT" alongside it) and add natural phrasings like "malware detection rules" to improve trigger term coverage.

Dimension	Reasoning	Score
Specificity	The description enumerates multiple concrete capabilities — "`condition:` syntax, hex patterns with wildcards, `for`/`any of them`, PE module, ELF module, hash module, math module. Build per-family signatures, hunt at scale via VT/MalwareBazaar/Hybrid Analysis. Avoid common pitfalls (collisions, slow rules, regex traps)" — giving comprehensive, specific coverage rather than vague domain naming.	5 / 5
Completeness	The "what" is explicit and detailed, but the description contains no "Use when..." clause or equivalent explicit trigger guidance — the when-to-use intent is relegated to `metadata.when_to_use` instead of the description, which caps completeness at 3 per the judging guidelines.	3 / 5
Trigger Term Quality	Strong natural terms are present ("YARA", "rule", "signature", "hunting", "MalwareBazaar", "Hybrid Analysis"), but "VT" is an abbreviation rather than the natural phrase "VirusTotal", and common user phrasings like "malware detection" or "write YARA rules" are not covered.	4 / 5
Distinctiveness Conflict Risk	"YARA rule authoring + hunting" is a clear niche with highly distinct triggers (YARA, signatures, VT/MalwareBazaar hunting); it is unlikely to fire for unrelated skills, with minimal overlap risk.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/reverser/yara-hunting/SKILL.md
Revision: 49888ee

Reviewed: 25 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

reverser-yara-hunting

Table of Contents

Is this your skill?