The Agent Skills Directory

[COMMAND_EXECUTION]: The skill guides the user in using command-line utilities including yr (the YARA-X CLI), floss (for static and stack string extraction), and yarGen (for candidate string generation) to analyze malware samples and validate rule effectiveness.
[EXTERNAL_DOWNLOADS]: Documentation and rule examples reference official repositories and threat research from well-known security entities such as VirusTotal, Elastic Security, Airbnb, Stairwell, and Objective-See. These references provide the necessary context for threat hunting and goodware testing.
[INDIRECT_PROMPT_INJECTION]: The skill includes Python scripts (yara_lint.py, atom_analyzer.py) designed to parse and analyze YARA rules provided by the user. While this creates an ingestion point for untrusted content, the behavior is localized to the linter's static analysis logic and is a standard requirement for development and security tools.
[SAFE]: The skill is authored by Trail of Bits and follows industry best practices for high-performance detection engineering, including detailed naming conventions, mandatory metadata fields, and rigorous testing against goodware corpora to prevent false positives.

yara-rule-authoring