yara-authoring plugin
YARA-X detection rule authoring with linting and quality analysis
How to install the yara-authoring plugin
Run both commands inside Claude Code. The first adds the marketplace once; the second installs the plugin.
/plugin marketplace add trailofbits/skills
/plugin install yara-authoring@trailofbitsWhat's inside yara-authoring
1 part read from the plugin's own files.
Skills 1
Claude loads it when the task matches- yara-rule-authoring
Guides the authoring, reviewing, and optimizing of high-quality YARA-X detection rules for malware identification and threat hunting.
Using yara-authoring in Claude Code
Skills need no command. Claude reads them when your request matches what they describe.
Update, turn off or remove
- Update the plugin (shell)
- claude plugin update yara-authoring@trailofbits
- Refresh the marketplace
- /plugin marketplace update trailofbits
- Turn it off for now
- /plugin disable yara-authoring@trailofbits
- Remove it
- /plugin uninstall yara-authoring@trailofbits
Skills in yara-authoring
Guides the authoring, reviewing, and optimizing of high-quality YARA-X detection rules for malware identification and threat hunting.
22 files8.1Kstars
yara-authoring plugin questions
How do I install the yara-authoring plugin?
In Claude Code run /plugin marketplace add trailofbits/skills, then /plugin install yara-authoring@trailofbits.
What does the yara-authoring plugin include?
yara-authoring bundles 1 skill.
How do I update or remove the yara-authoring plugin?
Update it with claude plugin update yara-authoring@trailofbits in your shell, or from the Installed tab of /plugin. Remove it with /plugin uninstall yara-authoring@trailofbits.