reverser-yara-hunting

YARA rule authoring + hunting — `condition:` syntax, hex patterns with wildcards, `for`/`any of them`, PE module, ELF module, hash module, math module. Build per-family signatures, hunt at scale via VT/MalwareBazaar/Hybrid Analysis. Avoid common pitfalls (collisions, slow rules, regex traps).

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A high-quality, action-oriented skill body with executable examples and a validation-bearing mass-hunt workflow; it is dense and well-structured, with only minor conciseness and progressive-disclosure gaps.

Dimension	Reasoning	Score
Conciseness	The body is dense and practical with minimal concept padding, but a few lines could be trimmed (e.g., the References aside 'Florian Roth's blog (the canonical YARA author of our era)'); efficient but not maximally lean.	4 / 5
Actionability	Provides copy-paste-ready full YARA rules, condition snippets, a curl command for MalwareBazaar, and yara CLI invocations with flags (-m, -p), covering the common authoring and hunting cases.	5 / 5
Workflow Clarity	The 'Mass-hunt workflow' gives a clear 6-step sequence with explicit validation checkpoints (must match known sample, must NOT match clean corpus, must NOT match a different family) and an iterate feedback loop, satisfying the batch-operation validation requirement.	5 / 5
Progressive Disclosure	Well-organized into clear sections (anatomy, condition tools, patterns, hunting, pitfalls, workflow, tooling, references) in a single self-contained file with no bundle files to split; minor gap is that the References are external URLs rather than clearly signaled local reference files.	4 / 5
	Total	18 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description with strong capability coverage and low conflict risk, but it lacks an explicit 'Use when...' trigger clause, which caps completeness and slightly weakens trigger-term quality.

Suggestions

Add an explicit 'Use when...' clause with concrete trigger phrases (e.g., 'Use when writing or tuning YARA rules, hunting malware families across VT/MalwareBazaar/Hybrid Analysis, or debugging rule collisions and slow scans').

Surface natural synonyms a user might say ('signatures', 'malware', 'detection rules') into the description itself rather than only in metadata.when_to_use.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete capabilities and constructs ("condition: syntax, hex patterns with wildcards, for/any of them, PE module, ELF module, hash module, math module", "Build per-family signatures, hunt at scale via VT/MalwareBazaar/Hybrid Analysis", "Avoid common pitfalls"), giving comprehensive coverage.	5 / 5
Completeness	The "what" is clearly stated, but there is no "Use when..." clause or equivalent explicit trigger guidance, which caps completeness at 3 per the rubric guidelines.	3 / 5
Trigger Term Quality	Includes natural terms a user would say ("YARA", "hunting", "VT/MalwareBazaar/Hybrid Analysis") but omits common synonyms like "signature" or "malware" that appear only in metadata, so coverage is good but not comprehensive.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (YARA rule authoring + hunting) with distinct triggers and named platforms, making conflict with other skills minimal.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/reverser/yara-hunting/SKILL.md
Commit: 31e1c8e

Reviewed: 10 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.