Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.
Install
npx skills add trailofbits/skills --skill yara-rule-authoringnpx skills add trailofbits/skills --skill yara-rule-authoring -a claude-code -gnpx skills add trailofbits/skills --skill yara-rule-authoring -a codex -ggemini skills install https://github.com/trailofbits/skills.git --path plugins/yara-authoring/skills/yara-rule-authoringgh skill install trailofbits/skills yara-rule-authoringgit clone --depth 1 https://github.com/trailofbits/skills /tmp/trailofbits__skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/trailofbits__skills/plugins/yara-authoring/skills/yara-rule-authoring ~/.claude/skills/yara-rule-authoring # Claude Code
cp -R /tmp/trailofbits__skills/plugins/yara-authoring/skills/yara-rule-authoring ~/.agents/skills/yara-rule-authoring # Codex, Cursor, Gemini CLI, Copilot, OpenCode