yara-rule-authoring
Write optimized YARA-X rules for malware detection, covering performance, platform-specifics, and migration.
Install
npx skills add https://github.com/trailofbits/skills --skill yara-rule-authoringStats
| Total installs | 982 |
| Weekly installs | 980 |
| GitHub stars | 4.0K |
| First seen | Jan 30, 2026 |
| Source | @trailofbits/skills |
Summary
- Covers naming conventions, string selection heuristics, and performance optimization through atom theory—includes decision trees for when to use hex vs. regex vs. modules
- Supports YARA-X (Rust-based successor) with 99% legacy YARA compatibility; includes migration guidance and new features like private patterns and built-in formatter
- Provides platform-specific guidance for Windows PE, macOS Mach-O, JavaScript/npm, Office documents, Chrome extensions (crx module), and Android apps (dex module)
- Includes expert heuristics for debugging false positives, goodware validation workflows, and a quality checklist covering metadata, string quality, and condition ordering
- Supplies example rules from Elastic, Airbnb, and Stairwell demonstrating graduated string counts, multi-category grouping, and obfuscation detection patterns
Tags
Related skills
| Skill | Installs | vs yara-rule-authoring |
|---|---|---|
| redis-development | 1,157 | +175 |
| test-master | 1,164 | +182 |
| aflpp | 1,161 | +179 |
| firebase | 912 | -70 |
| cairo-vulnerability-scanner | 1,169 | +187 |
FAQ
- How many installs does yara-rule-authoring have?
- yara-rule-authoring has 982 total installs and 980 installs this week.
- Where is yara-rule-authoring hosted?
- yara-rule-authoring is published by @trailofbits/skills at https://github.com/trailofbits/skills.
- How many GitHub stars does yara-rule-authoring have?
- yara-rule-authoring has 4.0K GitHub stars.
- When was yara-rule-authoring first indexed?
- OrangeBot.AI first indexed yara-rule-authoring on Jan 30, 2026.
- How do I install yara-rule-authoring?
- Run: npx skills add https://github.com/trailofbits/skills --skill yara-rule-authoring