yara-rule-authoring — Claude Code skill: what it does, how to install
Authors and reviews YARA-X detection rules for malware hunting, flagging strings that produce weak atoms and conditions that will fire on clean files.
npx skills add trailofbits/skills --skill yara-rule-authoring -a claude-codeWhat yara-rule-authoring does
The skill walks through writing YARA-X rules, the Rust rewrite of YARA, for spotting malware. Most of it is judgement calls: a string has to yield usable atoms (the engine matches on four-byte chunks), a rule should name a family rather than a category, and conditions run cheap checks first — filesize, then magic bytes, strings, modules.
Helper scripts sit next to the installed SKILL.md: a linter yara_lint.py, an atom analyzer atom_analyzer.py and a review helper review.sh. Resolve their paths from the skill directory and pass absolute paths in quotes. YARA-X itself is separate: brew install yara-x or cargo install yara-x, with yr as the CLI.
Endianness is the trap. uintNN() reads little-endian, so a ZIP file starting with bytes 50 4B 03 04 needs uint32(0) == 0x04034B50. Written the other way round, the check compiles and matches nothing, and the same mistake bites on Mach-O universal binaries. Run yr scan on one known-clean sample before trusting the rule.
What it helps with
- draft a YARA-X rule for one malware family instead of a vague category
- check a finished rule for weak atoms before shipping it
- port legacy YARA rules over to YARA-X
- inspect Chrome extensions and Android apps with the crx and dex modules
- cut false positives on Windows system files
Example prompts for the agent
- Write a YARA-X rule for the LockBit 3.0 config block, then run the atom analyzer over its strings.
- Lint my rule file with `yara_lint.py` and tell me which strings will match too often.
- Convert this old rule to YARA-X and check the Mach-O magic bytes.
How to install yara-rule-authoring
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill yara-rule-authoring -a claude-code2Manually: put the files in place
~/.claude/skills/yara-rule-authoring/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/yara-rule-authoring/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill yara-rule-authoring -a codex2Manually: put the files in place
.agents/skills/yara-rule-authoring/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill yara-rule-authoring -a cursor2Manually: put the files in place
.cursor/skills/yara-rule-authoring/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install trailofbits/skills yara-rule-authoring2Manually: put the files in place
.github/skills/yara-rule-authoring/SKILL.md1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill yara-rule-authoring -a gemini-cli2Platform CLI
gemini skills install https://github.com/trailofbits/skills --path plugins/yara-authoring/skills/yara-rule-authoringManually: put the files in place
.devin/skills/yara-rule-authoring/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add trailofbits/skills --skill yara-rule-authoring -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
From the same set35
The whole set →Similar
Questions about yara-rule-authoring
How do I install yara-rule-authoring in Claude Code?
Run npx skills add trailofbits/skills --skill yara-rule-authoring -a claude-code. The skill lands at ~/.claude/skills/yara-rule-authoring/SKILL.md.
What does yara-rule-authoring do?
It guides writing and reviewing YARA-X rules: string choice, atoms, condition order, metadata, migration from legacy YARA. It also covers the crx and dex modules for Chrome extensions and Android apps.
How is YARA-X different from legacy YARA?
It is a Rust rewrite with stricter validation, a built-in formatter and 99% rule compatibility, and its regex engine runs 5-10 times faster. New crx and dex modules come with it, and existing rules move over through a dedicated migration section.
