yara-rule-authoring
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill includes a robust suite of local analysis tools (
yara_lint.py,atom_analyzer.py, andreview.sh) designed to validate YARA-X rules for syntax, metadata compliance, and scanning performance. - [SAFE]: All scripts utilize standard security practices, such as using the
--argument separator in shell commands to prevent flag injection and usingjqfor safe JSON construction. - [SAFE]: Dependencies are limited to the official
yara-xPython library, and the skill provides clear guidance on secure rule authoring, such as avoiding unbounded regex and prioritizing cheap filters to prevent performance-based denial of service during scanning. - [SAFE]: Example rules and reference documentation provided are high-quality, attributed to reputable sources (e.g., Airbnb, Elastic Security, Stairwell Research), and are used strictly for educational and detection purposes.
Audit Metadata