ti-yara-hunting

YARA rule writing from behavioral observations and TI report analysis — sample-to-rule conversion, condition optimization, performance tuning, and retrohunting on VirusTotal and ANY.RUN. Covers YARA/YARA-X syntax, yarGen automated generation, and production rule deployment.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/ti-yara-hunting/SKILL.md

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced skill with strong workflows and validation checkpoints for batch/destructive retrohunt operations. The main weaknesses are mild verbosity from cataloging YARA syntax fundamentals and a monolithic single-file structure with no bundle references despite its length.

Suggestions

Move the YARA syntax catalog (String Types, Condition Essentials) and the full VT/ANY.RUN API examples into reference files (e.g. references/syntax.md, references/retrohunt-api.md) and link them one level deep from SKILL.md.

Trim basic syntax explanations Claude already knows (e.g. the meaning of '??' wildcards, 'all of them') to tighten conciseness.

De-duplicate install commands between the Quick Reference block and the Tools & Resources table.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and example-heavy, but sections like the String Types and Condition Essentials catalog YARA syntax fundamentals Claude already knows, and the Quick Reference repeats install commands also covered in the Tools table; could be tightened.	3 / 5
Actionability	Fully executable throughout — copy-paste bash/yara snippets, concrete curl API calls with payloads, a step-by-step sample-to-rule pipeline, and a numbered yarGen review checklist covering common cases.	5 / 5
Workflow Clarity	Multi-step processes are clearly sequenced with validation checkpoints: Section 2's numbered sample-to-rule steps, the retrohunting end-to-end flow ('validate locally — must match known sample, must NOT match goodware'), and the Decision Gate with explicit IF/then routing and error-recovery branches.	5 / 5
Progressive Disclosure	Well-organized into headed sections, but no bundle files exist and all content is inlined in a single ~440-line SKILL.md; substantial reference material (full syntax catalog, API examples, detection-signature and error tables) that could live in separate files is inline, and the one cross-skill pointer (ti-ioc-extraction) is a skill name rather than a navigable reference.	3 / 5
	Total	16 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-triggered description with concrete actions and tool/platform names. Its main weakness is the absence of an explicit 'Use when...' clause in the description text itself, relying on metadata.when_to_use instead, which caps completeness.

Suggestions

Append an explicit 'Use when...' clause to the description, e.g. 'Use when writing or tuning YARA rules from samples or TI reports, or retrohunting for malware variants on VirusTotal and ANY.RUN.'

Consider surfacing the key trigger terms (yara rule, retrohunt, livehunt) directly in the description sentence rather than only in metadata.when_to_use.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'sample-to-rule conversion, condition optimization, performance tuning, and retrohunting on VirusTotal and ANY.RUN' — covering the full pipeline with named platforms.	5 / 5
Completeness	Has a clear and comprehensive 'what' but no explicit 'Use when...' / 'when should Claude use it' clause; trigger guidance lives only in the metadata.when_to_use field rather than in the description itself, which caps completeness at 3 per the rubric.	3 / 5
Trigger Term Quality	Comprehensive natural terms including synonyms and tool names — 'yara, yara rule, yara-x, yargen, retrohunt, retrohunting, virustotal hunting, anyrun yara search, malware signature, livehunt' — exactly what a user would say.	5 / 5
Distinctiveness Conflict Risk	Clear niche (YARA hunting on VT/ANY.RUN) with distinct tool- and platform-specific triggers, minimal overlap risk with other skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/analyst/ti-yara-hunting/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.