Agent skill
yara
Create YARA rules for file/memory pattern matching
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/yara
SKILL.md
YARA Rule Creation
Create file-based detection signatures:
- String patterns
- Hex byte patterns
- PE characteristics
- Import analysis
- Entropy checks
Required Context
- Sample: Malware sample or pattern description
- Strings: Key strings to match
- Context: Malware family, false positive considerations
Output
- YARA rule with metadata
- Test commands
Testing
yara -s rule.yar sample.exe
yara -r rule.yar /samples/
Example
/yara
Sample: /samples/cobalt_beacon.exe
Focus: Unique strings, API imports
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?