thor-plugins

Create and deploy THOR plugins with Init, metadata.yml, and ZIP packaging.

12|2|Updated Jan 17, 2026

Search Tags:#automation #go #packaging #plugin #extension #thor #yara

Ready to run

npx skills add https://github.com/NextronSystems/thor-skill --skill thor-plugins

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: thor-plugins
Source: https://github.com/NextronSystems/thor-skill/tree/main/thor-plugins
Command: npx skills add https://github.com/NextronSystems/thor-skill --skill thor-plugins

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Create and deploy THOR plugins to extend the scanner's capabilities.

Core Features & Use Cases

Plugin development workflow with a defined Init entry point for THOR plugins
Packaging as ZIP with a metadata.yml and optional vendor/ to deploy into THOR
Real-world use cases including custom parsers, YARA hooks, and post-processing integrations

Quick Start

Create a THOR plugin by implementing Init, add a metadata.yml, package as a ZIP, copy to THOR's plugins directory, and run THOR to load it.

Frequently Asked Questions about thor-plugins

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I create custom YARA detection plugins for THOR scanner?▼

Create custom YARA hooks by implementing a THOR plugin with a defined Init entry point. Package the plugin as a ZIP file containing a metadata.yml file, then deploy it into the THOR plugins directory to load your custom detections.

What is the required file structure for packaging and deploying a THOR plugin?▼

Packaging a THOR plugin requires a ZIP archive containing a metadata.yml file and an optional vendor/ directory. You deploy the plugin by copying this ZIP file into the THOR scanner's plugins directory and running THOR to load it.

Can I build custom parsers and post-processing integrations for THOR v11?▼

Yes, you can extend the THOR scanner's capabilities by building custom parsers and post-processing integrations. The plugin development workflow enforces a standard structure with an Init entry point for THOR v11 and later versions.

Does the THOR plugin development workflow require any external dependencies?▼

No external dependencies are required for THOR plugin development. The workflow enforces a standard plugin structure and packaging process that relies solely on implementing the Init entry point and creating a metadata.yml file.

What is the best way to extend THOR scanner capabilities with custom detections?▼

The best way to extend THOR scanner capabilities is by creating and deploying custom plugins. You implement an Init function, package the code as a ZIP with metadata.yml, and copy it to the THOR plugins directory to load your detections.

When should I not use the standard THOR plugin packaging workflow?▼

You should not use the standard THOR plugin packaging workflow if you are developing for THOR versions older than v11. The enforced plugin structure, Init entry point, and metadata.yml deployment process apply specifically to THOR v11 and later.