agentsclimarketplace
Sign in

Author yara x rules

Skill gaelic-ghost/socket/plugins/cybersecurity-skills/skills/author-yara-x-rules

Author, test, tune, and document YARA-X detection rules from validated artifact evidence. Use when malware, suspicious files, scripts, documents, or binary features need local pattern detection with stable discriminators, metadata, positive and negative fixtures, performance checks, false-positive review, rule provenance, and regression testing.From its SKILL.md

Install
npx -y skills add gaelic-ghost/socket --skill author-yara-x-rules

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.1 KB, 335 tokens by cl100k_base, as published. Nobody here has run it

Author YARA-X Rules

Overview

Create rules that detect the validated property the evidence supports, not a broader malware-family claim. Prefer structural combinations over unique-looking strings copied from one sample.

Read references/yara-x-rule-quality.md before selecting patterns or declaring coverage.

Workflow

  1. Define the detection objective and non-goals.
  2. Build the fixture set.
    • Preserve representative positive samples and near-miss benign negatives with hashes and provenance.
    • Use synthetic or redistributable fixtures for repository tests.
  3. Select discriminators.
    • Prefer format/module facts, byte structures, stable code/config fragments, and combinations of independently meaningful strings.
    • Avoid mutable infrastructure, compiler boilerplate, paths, timestamps, or one generic API name as decisive evidence.
  4. Author metadata and conditions.
    • Include purpose, author, date, source/evidence reference, scope, confidence, and known limitations.
    • Bound file type and size where it improves correctness or performance.
  5. Validate with current YARA-X.
    • Record version; compile/lint the rule; test all positives, negatives, malformed inputs, and a bounded benign corpus.
    • Investigate timeouts, warnings, and module-undefined behavior.
  6. Review false positives and coverage.
    • Tune by improving evidence combinations, not by accumulating arbitrary exclusions.
  7. Preserve regression evidence.
    • Store allowed fixtures or deterministic generators, expected matches/non-matches, and rule revision.

Output

Return the rule, objective, evidence basis, fixture results, performance notes, known misses/false positives, and deployment limits.

What ships with it: 2 files

912 B alongside SKILL.md

agents/

references/

Gives 0 of the 12 instructions most test skills give in 335 tokens

Counted across 964 of the 1,571 authors here whose files we hold, read 2026-08-07

  • Close the browser when donein 55 of 964, across 12 files
  • Wait for network idle statein 51 of 964, across 6 files
  • Launch Chromium in headless modein 49 of 964, across 6 files
  • Use descriptive selectors for elementsin 49 of 964, across 6 files
  • Run provided scripts with help flag firstin 49 of 964, across 6 files
  • Add appropriate explicit waitsin 48 of 964, across 5 files
  • Use bundled scripts as black boxesin 46 of 964, across 3 files
  • Do not read script source codein 46 of 964, across 3 files
  • Use sync playwright for scriptsin 46 of 964, across 3 files
  • Inspect dom before executing actionsin 46 of 964, across 3 files
  • Run the full test suitein 37 of 964
  • Write the failing test firstin 29 of 964, across 23 files

Said here and by no other author read

  • Define the detection objective and non-goals
  • Build a fixture set with positive and negative samples
  • Prefer structural combinations over copied sample strings
  • Avoid mutable infrastructure as decisive evidence
  • Include purpose, author, date, source, scope, confidence, and limitations
  • Bound file type and size for correctness or performance

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 326,861. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.