yara-rule-authoring

Validate YARA-X rule syntax, metadata, and atom quality with linting.

6.5k|561|Updated Jan 14, 2026
One-click install
npx skills add https://github.com/trailofbits/skills --skill yara-rule-authoring
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: yara-rule-authoring
Source: https://github.com/trailofbits/skills/tree/main/plugins/yara-authoring/skills/yara-rule-authoring
Command: npx skills add https://github.com/trailofbits/skills --skill yara-rule-authoring

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires yara-x, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill streamlines the creation, validation, and maintenance of YARA-X rules by enforcing consistent metadata, naming, and performance practices, reducing false positives and deployment risk.

Core Features & Use Cases

  • Linting and metadata validation using yara-lint.py and yr check to catch syntax, metadata gaps, and anti-patterns.
  • Reference and module guidance for CRX (Chrome extensions) and DEX (Android) analysis, plus performance-oriented rule design.
  • Structured templates and best-practices for scalable rule development across PE, CRX, and DEX targets with production-grade testing.

Quick Start

Write a YARA-X rule and run the linting and validation workflow to ensure proper metadata, naming, and atom quality before deployment.

Frequently Asked Questions about yara-rule-authoring

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I validate YARA-X rule syntax and metadata before deployment?

You can validate YARA-X rule syntax and metadata by running the yr check command and custom yara-lint.py scripts to enforce required fields like description, author, date, and reference. This ensures proper atom quality and catches anti-patterns.

What is the best way to enforce consistent naming conventions in a YARA rule repository?

Enforcing consistent YARA rule naming conventions is handled by applying custom lint scripts and yr fmt to standardize rule definitions across production repositories. This automation reduces false positives and deployment risk.

Does yara-x linting support analysis for Android DEX and Chrome CRX files?

Yes, yara-x linting supports analysis for Android DEX and Chrome CRX files by providing reference and module guidance for these targets. It includes structured templates and performance-oriented rule design for scalable development.

Why does my YARA rule fail validation due to missing metadata?

YARA rule validation fails when required metadata fields are missing because the linting workflow strictly enforces the presence of description, author, date, and reference tags. This metadata is required to maintain production-grade rule quality.

Can I automate YARA-X rule formatting for a continuous development workflow?

You can automate YARA-X rule formatting in development workflows by integrating yr fmt and validation scripts into your pipeline. This applies strict string guidelines and performance guidance automatically before deployment.

What performance guidance does yara-x provide for authoring PE rules?

Yara-x provides performance guidance for authoring PE rules by evaluating atom quality and flagging anti-patterns during the yr check validation process. This ensures rules are optimized for production environments.