yara-authoring
๐Plugintrailofbits/skills
|YARA-X detection rule authoring with linting and quality analysis
Overview
A YARA detection rule authoring plugin from Trail of Bits that provides linting, atom analysis, and best practices guidance for writing YARA-X rules. Part of the Trail of Bits Skills collection covering security research, malware analysis, reverse engineering, and development.
Key Features
- YARA-X rule authoring โ Write detection rules with expert guidance on syntax, patterns, and conditions
- Linting โ Automated quality checks for YARA rules to catch common mistakes
- Atom analysis โ Analyze rule atoms for detection coverage and performance optimization
- Best practices โ Built-in guidance from Trail of Bits security researchers on effective rule writing
- Part of Trail of Bits Skills โ Alongside plugins for constant-time analysis, property-based testing, spec-to-code compliance, Firebase APK scanning, and more
Who is this for?
Security researchers, threat hunters, and malware analysts who write YARA detection rules and want AI-assisted authoring with quality checks. Ideal for teams doing threat detection engineering who need consistent, high-quality YARA rules.
Part of
trailofbits-skills
Installation
/plugin marketplace add trailofbits/skills/plugin install yara-authoring@trailofbitsMore from this repository10
A Claude Code plugin marketplace from Trail of Bits providing skills for AI-assisted security analysis, testing, and development workflows.
Runs Semgrep static analysis for security vulnerability detection and code quality enforcement, from the Trail of Bits Skills Marketplace for AI-assisted security workflows.
A Claude Code plugin marketplace from Trail of Bits providing skills for AI-assisted security analysis, testing, and development workflows.
A Claude Code plugin marketplace from Trail of Bits providing skills for AI-assisted security analysis, testing, and development workflows.
A Claude Code plugin marketplace from Trail of Bits providing skills for AI-assisted security analysis, testing, and development workflows.
Teaches design patterns for workflow-based Claude Code skills and provides a review agent for auditing existing skills
Safely analyzes and cleans up local git branches and worktrees by categorizing them as merged, squash-merged, superseded, or active work.
Property-based testing guidance for multiple languages and smart contracts
Plugin
Creates language variants of existing Semgrep rules with proper applicability analysis and test-driven validation