yara-rule-authoring

Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an exceptionally actionable, well-sequenced expert reference with strong workflows and validation, assuming Claude's competence throughout. Its main weakness is progressive disclosure: several prominently advertised navigation targets (the examples directory, the full workflow guide, the repo README) are dead links, undermining the otherwise excellent file structure.

Suggestions

Create the missing `examples/` directory with the five referenced `.yar` files, or remove the examples table — dead links break the navigation the skill promises.

Add `workflows/rule-development.md` (referenced as "the full step-by-step guide") or remove the two links to it, so the headline workflow pointer resolves.

Trim the promotional intro ("5-10x faster regex… powers VirusTotal's production systems") to tighten conciseness toward the every-token-earns-its-place bar.

Dimension	Reasoning	Score
Conciseness	The body is remarkably lean for its scope — no "what is YARA" filler, dense tables and concrete values throughout — but the promotional intro ("5-10x faster regex… powers VirusTotal's production systems") and a few expert-quote attributions are minor tokens that could be trimmed, keeping it just below the every-token-earns-its-place bar.	4 / 5
Actionability	Fully executable guidance throughout: copy-paste `yr check`/`yr fmt`/`yr scan -s` commands, concrete YARA rule examples with real byte sequences, and named tools with exact invocation flags (e.g. `yarGen.py -m samples/ --excludegood`, `floss sample.exe`) covering the common platform cases.	5 / 5
Workflow Clarity	A clear 7-step Workflow sequence is backed by an explicit Quality Checklist, a Debugging-False-Positives feedback loop, and a migration fix-then-verify-without-relaxed-mode loop; validation (goodware corpus, `yr check`, linter) is present, so the destructive/batch cap does not apply.	5 / 5
Progressive Disclosure	Structure and one-level-deep signaling are good and the six referenced `references/*.md` files all exist, but navigation is materially broken by dead links: `workflows/rule-development.md` (referenced twice as "the full step-by-step guide"), the entire `examples/` directory with five named `.yar` files, and `../../README.md` — none of which exist in the bundle.	3 / 5
	Total	17 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary description: it states the what, gives an explicit Use-when clause, enumerates concrete capabilities, and lists natural trigger terms including synonyms and module names. It is concise, third-person, and highly distinct from other skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "writing, reviewing, or optimizing YARA rules" plus "naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction" — giving comprehensive coverage of the skill's capabilities.	5 / 5
Completeness	Explicitly answers both what ("Guides authoring of high-quality YARA-X detection rules for malware identification") and when ("Use when writing, reviewing, or optimizing YARA rules" + a "Triggers on:" list of concrete trigger phrases).	5 / 5
Trigger Term Quality	Comprehensive natural-term coverage including the synonym pair (YARA, YARA-X) and module names (crx module, dex module), alongside malware detection, threat hunting, IOC, signature — terms a user would naturally say.	5 / 5
Distinctiveness Conflict Risk	YARA-X rule authoring is a clear niche with distinct triggers (YARA, YARA-X, crx/dex modules); minimal risk of firing for an unrelated skill.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 7 missing, 1 suspicious	Warning

	Total	15 / 16 Passed

Repository: trailofbits/skills
Path: plugins/yara-authoring/skills/yara-rule-authoring/SKILL.md
Commit: 04b2411

Reviewed: about 11 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.