agentsclimarketplace

Author yara x rules

Skill gaelic-ghost/socket/skills/author-yara-x-rules

The Source for macOS Agent Workflows

Install
npx -y skills add gaelic-ghost/socket --skill author-yara-x-rules

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Author, test, tune, and document YARA-X detection rules from validated artifact evidence. Use when malware, suspicious files, scripts, documents, or binary features need local pattern detection with stable discriminators, metadata, positive and negative fixtures, performance checks, false-positive review, rule provenance, and regression testing.

SKILL.md

2.1 KB, as published. Nobody here has run it

Author YARA-X Rules

Overview

Create rules that detect the validated property the evidence supports, not a broader malware-family claim. Prefer structural combinations over unique-looking strings copied from one sample.

Read references/yara-x-rule-quality.md before selecting patterns or declaring coverage.

Workflow

  1. Define the detection objective and non-goals.
  2. Build the fixture set.
    • Preserve representative positive samples and near-miss benign negatives with hashes and provenance.
    • Use synthetic or redistributable fixtures for repository tests.
  3. Select discriminators.
    • Prefer format/module facts, byte structures, stable code/config fragments, and combinations of independently meaningful strings.
    • Avoid mutable infrastructure, compiler boilerplate, paths, timestamps, or one generic API name as decisive evidence.
  4. Author metadata and conditions.
    • Include purpose, author, date, source/evidence reference, scope, confidence, and known limitations.
    • Bound file type and size where it improves correctness or performance.
  5. Validate with current YARA-X.
    • Record version; compile/lint the rule; test all positives, negatives, malformed inputs, and a bounded benign corpus.
    • Investigate timeouts, warnings, and module-undefined behavior.
  6. Review false positives and coverage.
    • Tune by improving evidence combinations, not by accumulating arbitrary exclusions.
  7. Preserve regression evidence.
    • Store allowed fixtures or deterministic generators, expected matches/non-matches, and rule revision.

Output

Return the rule, objective, evidence basis, fixture results, performance notes, known misses/false positives, and deployment limits.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.