此内容尚未提供您的语言版本,正在以英文显示。

Yara Authoring

插件活跃

YARA-X detection rule authoring with linting and quality analysis

1 个 Skill 0 个 MCP

目的

To empower users to write high-quality, efficient, and accurate YARA-X detection rules by providing expert guidance, analysis tools, and best practices.

功能

Expert YARA-X rule authoring guidance
Rule linting and quality analysis
String quality evaluation
YARA-X migration support
Analysis of Chrome extensions and Android DEX files

使用场景

Writing new YARA-X rules for malware detection
Reviewing and optimizing existing YARA rules
Converting threat intelligence into detection signatures
Debugging false positive issues in YARA rules

非目标

Static analysis requiring disassembly
Dynamic malware analysis
Network-based detection
Memory forensics

Trust

warning:Issues Attention13 issues opened and 4 closed in the last 90 days indicates a low closure rate (24%), suggesting maintainers are slow to respond to open issues.

安装

请先添加 Marketplace

/plugin marketplace add trailofbits/skills

/plugin install yara-authoring@trailofbits

包含 1 个扩展

Skill (1)

Yara Rule Authoring 技能

Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.

质量评分

77 /100

1 day ago 分析

信任信号

最近提交3 days ago

GitHub 所有者 trailofbits

星标5.2k

许可证CC-BY-SA-4.0

状态

查看源代码

类似扩展

Dotforge Stack Python Fastapi

100

Python 3.12+ with FastAPI, async/await, type hints, and Ruff linting rules for Claude Code.

插件

luiseiman

Karpathy Coder

100

Active coding discipline enforcer based on Karpathy's 4 principles: surface assumptions, keep it simple, make surgical changes, define verifiable goals. Ships 4 Python tools (complexity_checker, diff_surgeon, assumption_linter, goal_verifier), a review agent, /karpathy-check slash command, and a pre-commit hook. All tools stdlib-only.

插件

alirezarezvani