YARA Rule Skill (Community Edition)

An LLM Agent Skill for expert YARA rule authoring, review, and optimization. Embeds industry best practices from the creator of YARA-Forge and yaraQA into your AI assistant’s context.

🎯 What This Skill Does

The yara-rule-skill transforms your LLM agent into a YARA rule expert, capable of:

• Writing high-quality, performant YARA rules from scratch
• Reviewing existing rules for quality issues and performance problems
• Optimizing slow rules by identifying performance bottlenecks
• Validating rules against 20+ automated quality checks from yaraQA

All through natural language conversation — just paste a rule and ask.

📦 Installation

Option 1: Clone and Copy (Recommended)

# Clone the repository
git clone https://github.com/YARAHQ/yara-rule-skill.git

# Copy to your agent's skills folder
cp -r yara-rule-skill ~/.openclaw/skills/

Option 2: Package as .skill File

# Clone the repository
git clone https://github.com/YARAHQ/yara-rule-skill.git
cd yara-rule-skill

# Package the skill
python3 scripts/package_skill.py .

# Install the packaged skill
cp yara-rule-skill.skill ~/.openclaw/skills/

Supported Platforms

This skill works with any LLM agent that supports skill files:

• OpenClaw — ~/.openclaw/skills/
• Claude Desktop — (skills folder location varies)
• Other MCP-based agents — Check your platform’s documentation

🚀 Usage

Once installed, the skill activates automatically when you discuss YARA rules. Just ask:

Use Case 1: Review My Rule

“Review this YARA rule and suggest improvements”

The skill analyzes:

• Naming conventions (MAL_, HKTL_, SUSP_, etc.)
• String selection (atom quality, modifiers)
• Condition logic (short-circuit evaluation)
• Metadata completeness

Use Case 2: Assess Public Rules

“Assess the quality of this rule I found online”

The skill checks against 20+ automated quality checks:

• Logic errors (conditions that never match)
• Performance issues (short atoms, unanchored regex)
• Style violations (naming, formatting)
• Resource problems (too many strings/regex)

Use Case 3: Performance Diagnosis

“This rule causes performance issues, why?”

The skill identifies:

• Missing regex anchors (.*, .+)
• Short atoms (< 4 bytes)
• Expensive calculations before cheap checks
• Module usage that could be replaced

📚 What’s Included

Core Knowledge

The skill combines three authoritative sources into your agent’s context:

1. YARA Performance Guidelines — Optimization techniques, atom selection, condition ordering
2. YARA Style Guide — Naming conventions, rule structure, metadata standards
3. yaraQA — 20+ automated quality checks