* feat(codex): add skill UI metadata * Use official Trail of Bits logo * fix: resolve code review findings for PR #175 Codex silently drops the icons as authored: its loader (codex-rs/core-skills resolve_asset_path) requires icon paths containing '..' to resolve under <plugin_root>/assets/, and the repo-root .codex/assets location fails that containment check. Verified empirically via codex app-server plugin/read: every iconSmall/iconLarge came back null; only brand_color applied. P1 fixed: - Vendor trail-of-bits-mark.svg into plugins/<name>/assets/ for all 38 plugins with skills and point every openai.yaml at ../../assets/trail-of-bits-mark.svg (the supported plugin-level shared asset pattern). Icons now resolve for marketplace installs too, since nothing escapes the plugin root. - Drop the .codex/ additions: .codex/skills/gh-cli/agents/ openai.yaml resolved nowhere (.codex/skills is not a Codex discovery root) and PR #173 removes the whole .codex/ tree P2 fixed: - Patch-bump all 38 touched plugins in plugin.json and marketplace.json so installed clients pick up the metadata Verified: - Static check replicating Codex's resolution algorithm: all 73 yaml files resolve under their plugin assets/ and exist - Live codex app-server probe: 71/72 loadable skills report resolved iconSmall/iconLarge and brand_color #D83A34 (claude-in-chrome-troubleshooting fails to load on main due to a pre-existing 64-char qualified-name limit, fixed by #173's rename; zeroize-audit's manifest mcpServers object is likewise a pre-existing Codex incompatibility fixed by #173) - validate_codex_skills.py, validate_plugin_metadata.py, prek all pass Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(codex): use skill-local icon assets --------- Co-authored-by: Dan Guido <dan@trailofbits.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
YARA-X Authoring Plugin
A behavior-driven skill for authoring high-quality YARA-X detection rules, teaching you to think and act like an expert YARA author.
YARA-X Focus: This skill targets YARA-X, the Rust-based successor to legacy YARA. YARA-X powers VirusTotal's Livehunt/Retrohunt production systems and is 5-10x faster for regex-heavy rules. Legacy YARA (C implementation) is in maintenance mode.
Philosophy
This skill doesn't dump YARA syntax at you. Instead, it teaches:
- Decision trees for common judgment calls (Is this string good enough? When to abandon an approach?)
- Expert heuristics (mutex names are gold, API names are garbage)
- Rationalizations to reject (the shortcuts that cause production failures)
An expert uses 5 tools: yarGen, FLOSS, yr CLI, signature-base, YARA-CI. Everything else is noise.
Installation
YARA-X CLI
# macOS
brew install yara-x
# Or from source
cargo install yara-x
# Verify installation
yr --version
Python Package (for scripts)
pip install yara-x
# or with uv
uv pip install yara-x
Plugin
Add this plugin to your Claude Code configuration:
claude mcp add-plugin /path/to/yara-authoring
Skills
yara-rule-authoring
Guides authoring of YARA-X rules for malware detection with expert judgment.
Covers:
- Decision trees for string quality, when to abandon approaches, debugging FPs
- Expert heuristics from experienced YARA authors
- Rationalizations to reject (common shortcuts that fail)
- Naming conventions (CATEGORY_PLATFORM_FAMILY_DATE format)
- Performance optimization (atom quality, short-circuit conditions)
- Testing workflow (goodware corpus validation)
- YARA-X migration guide for converting legacy rules
- Chrome extension analysis with
crxmodule - Android DEX analysis with
dexmodule
Triggers: YARA, YARA-X, malware detection, threat hunting, IOC, signature
Scripts
The skill includes two Python scripts that require uv to run:
yara_lint.py
Validates YARA-X rules for style, metadata, compatibility issues, and anti-patterns:
uv run yara_lint.py rule.yar
uv run yara_lint.py --json rules/
uv run yara_lint.py --strict rule.yar
atom_analyzer.py
Evaluates string quality for efficient atom extraction:
uv run atom_analyzer.py rule.yar
uv run atom_analyzer.py --verbose rule.yar
Reference Documentation
| Document | Purpose |
|---|---|
| style-guide.md | Naming conventions, metadata requirements |
| performance.md | Atom theory, optimization techniques |
| strings.md | String selection judgment, good/bad patterns |
| testing.md | Validation workflow, FP investigation |
Key Resources
- YARA-X Documentation (official)
- YARA-X GitHub
- Neo23x0 YARA Style Guide
- Neo23x0 Performance Guidelines
- signature-base Rule Collection
- YARA-CI
Requirements
The scripts use PEP 723 inline metadata, so dependencies are resolved automatically by uv run.
Migrating from Legacy YARA
If you have existing rules written for legacy YARA:
- Run validation:
yr check --relaxed-re-syntax rules/ - Fix issues identified (see SKILL.md migration section)
- Validate without relaxed mode:
yr check rules/
Note: Use
--relaxed-re-syntaxonly as a temporary diagnostic tool. Fix all identified issues rather than relying on relaxed mode permanently.
Common migration issues:
- Unescaped
{in regex patterns - Invalid escape sequences (
\R→\\R) - Base64 patterns on strings < 3 characters
- Negative array indexing