Yara Authoring

YARA-X Authoring Plugin

A behavior-driven skill for authoring high-quality YARA-X detection rules, teaching you to think and act like an expert YARA author.

**YARA-X Focus:** This skill targets [YARA-X](https://virustotal.github.io/yara-x/), the Rust-based successor to legacy YARA. YARA-X powers VirusTotal's Livehunt/Retrohunt production systems and is 5-10x faster for regex-heavy rules. Legacy YARA (C implementation) is in maintenance mode.

Philosophy

This skill doesn't dump YARA syntax at you. Instead, it teaches:

undefined

An expert uses 5 tools: yarGen, FLOSS, `yr` CLI, signature-base, YARA-CI. Everything else is noise.

Installation

YARA-X CLI

# macOS
brew install yara-x

# Or from source
cargo install yara-x

# Verify installation
yr --version

Python Package (for scripts)

pip install yara-x
# or with uv
uv pip install yara-x

Plugin

Add this plugin to your Claude Code configuration:

claude mcp add-plugin /path/to/yara-authoring

Skills

yara-rule-authoring

Guides authoring of YARA-X rules for malware detection with expert judgment.

**Covers:**

undefined

**Triggers:** YARA, YARA-X, malware detection, threat hunting, IOC, signature

Scripts

...