Claude Skill

yara-rules

Author and compile YARA-X rules for SDTM-v1. Use when adding or changing detectors, rules/*.yar, rule IDs, or taxonomy mappings.

LLM Mart · 0 points · 9 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download KalarisLabs-Skill-Doctor-skills_yara-rules-9413620.zip · 0 KB

kalarislabs/skill-doctor 13 1 forks Apache-2.0 Updated 7d ago

Part of kalarislabs/skill-doctor — 15 skills

Install

skills CLI npx skills add https://github.com/KalarisLabs/Skill-Doctor/tree/main/skills/yara-rules

Claude Code

claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install kalarislabs-skill-doctor@llmmart

Git git clone https://github.com/KalarisLabs/Skill-Doctor.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole kalarislabs/skill-doctor collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

YARA-X rules

One file per class under rules/core/sdXX_*.yar. Extra packs: supply-chain, obfuscation, MCP.
IDs are stable and human-assigned. Never renumber. Baselines and suppressions depend on this.
skill-doctor-rules/build.rs compiles the tree once. Scan path only matches.
Every rule meta: class, severity, description.
SD-02 companion-script taint is tree-sitter, not a regex for the eval function.
SD-04 is capability-set differ, not YARA. Do not fake it with a pattern.
New class SD-12+ is a whitepaper change. Do not add it in a drive-by PR.
Detector PR: rule + positive fixture + hard-negative + test.

Files (skill-doctor)

SKILL.md 819 B

---
name: yara-rules
description: Author and compile YARA-X rules for SDTM-v1. Use when adding or changing detectors, rules/*.yar, rule IDs, or taxonomy mappings.
---

# YARA-X rules

- One file per class under `rules/core/sdXX_*.yar`. Extra packs: supply-chain, obfuscation, MCP.
- IDs are stable and human-assigned. Never renumber. Baselines and suppressions depend on this.
- `skill-doctor-rules/build.rs` compiles the tree **once**. Scan path only matches.
- Every rule `meta`: `class`, `severity`, `description`.
- SD-02 companion-script taint is **tree-sitter**, not a regex for the `eval` function.
- SD-04 is capability-set differ, not YARA. Do not fake it with a pattern.
- New class SD-12+ is a whitepaper change. Do not add it in a drive-by PR.
- Detector PR: rule + positive fixture + hard-negative + test.