thor-plugins

Write and deploy Go-based THOR plugins to extend scanner capabilities.

12|2|Updated Jan 17, 2026

Search Tags:#hooks #go #packaging #plugin #scanning #thor #yara

Ready to run

npx skills add https://github.com/Nextron-Labs/thor-skill --skill thor-plugins-nextron-labs

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: thor-plugins
Source: https://github.com/Nextron-Labs/thor-skill/tree/main/thor-plugins
Command: npx skills add https://github.com/Nextron-Labs/thor-skill --skill thor-plugins-nextron-labs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

THOR plugin development enables users to create and package custom plugins to extend THOR's scanning capabilities, load new logic at runtime, and tailor THOR to their environment.

Core Features & Use Cases

Extend THOR with custom plugins written in Go to parse additional file formats, implement advanced detection logic beyond built-in rules, and post-process findings.
Package plugins as ZIPs containing plugin.go and metadata.yml and deploy them to THOR's plugins directory to load automatically at startup.
Define YARA rules and rule hooks to trigger actions during scans and flexibly react to detections.

Quick Start

Create a new THOR plugin by implementing Init in plugin.go, adding a metadata.yml, optionally vendoring dependencies, and packaging the files into a ZIP for THOR.

Frequently Asked Questions about thor-plugins

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I write custom plugins to extend THOR scanner capabilities?▼

To write custom THOR plugins, implement the Init function in a Go file, define a metadata.yml, optionally vendor dependencies, and package the files into a ZIP for deployment. This allows you to load new logic at runtime and tailor THOR to your environment.

What do I need to develop custom scanning logic for unsupported file formats in THOR?▼

Developing custom scanning logic for unsupported file formats in THOR requires a Go development environment and THOR v11 or later. You write the parsing or detection logic in Go, package it as a ZIP, and deploy it to the plugins directory to load automatically at startup.

Can I use YARA rules to trigger custom actions during THOR scans?▼

Yes, you can define YARA rules and rule hooks within your custom plugins to trigger specific actions during THOR scans. This mechanism allows you to flexibly react to detections and implement advanced post-processing of findings.

How do I package and deploy Go plugins for THOR v11+?▼

Package Go plugins for THOR v11+ by creating a ZIP archive containing your plugin.go file and a metadata.yml file. Deploy the ZIP to THOR's plugins directory, where the scanner will automatically load and execute the custom logic at startup.

When should I extend THOR with custom plugins instead of built-in rules?▼

You should extend THOR with custom plugins when you need to parse unsupported file formats, implement advanced detection logic beyond built-in rules, or post-process findings within THOR v11+. Plugins provide runtime extensibility for tailored environmental scanning.