agentsclimarketplace
Sign in

Author yara x rules

Skill gaelic-ghost/socket/plugins/cybersecurity-skills/skills/author-yara-x-rules

Author, test, tune, and document YARA-X detection rules from validated artifact evidence. Use when malware, suspicious files, scripts, documents, or binary features need local pattern detection with stable discriminators, metadata, positive and negative fixtures, performance checks, false-positive review, rule provenance, and regression testing.From its SKILL.md

Install
npx -y skills add gaelic-ghost/socket --skill author-yara-x-rules

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.1 KB, 335 tokens by cl100k_base, as published. Nobody here has run it

Author YARA-X Rules

Overview

Create rules that detect the validated property the evidence supports, not a broader malware-family claim. Prefer structural combinations over unique-looking strings copied from one sample.

Read references/yara-x-rule-quality.md before selecting patterns or declaring coverage.

Workflow

  1. Define the detection objective and non-goals.
  2. Build the fixture set.
    • Preserve representative positive samples and near-miss benign negatives with hashes and provenance.
    • Use synthetic or redistributable fixtures for repository tests.
  3. Select discriminators.
    • Prefer format/module facts, byte structures, stable code/config fragments, and combinations of independently meaningful strings.
    • Avoid mutable infrastructure, compiler boilerplate, paths, timestamps, or one generic API name as decisive evidence.
  4. Author metadata and conditions.
    • Include purpose, author, date, source/evidence reference, scope, confidence, and known limitations.
    • Bound file type and size where it improves correctness or performance.
  5. Validate with current YARA-X.
    • Record version; compile/lint the rule; test all positives, negatives, malformed inputs, and a bounded benign corpus.
    • Investigate timeouts, warnings, and module-undefined behavior.
  6. Review false positives and coverage.
    • Tune by improving evidence combinations, not by accumulating arbitrary exclusions.
  7. Preserve regression evidence.
    • Store allowed fixtures or deterministic generators, expected matches/non-matches, and rule revision.

Output

Return the rule, objective, evidence basis, fixture results, performance notes, known misses/false positives, and deployment limits.

What ships with it: 2 files

912 B alongside SKILL.md

agents/

references/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.