YARA Rule Skill

---
name: yara-rule-skill
description: Writes, reviews, and optimizes YARA rules using the YARA Style Guide, the YARA Performance Guidelines, yaraQA checks, and YARA-Forge quality criteria. Use when the user wants a new YARA rule, a review or quality assessment of an existing rule or rule set, help with a slow, noisy, or non-compiling rule, an explanation of a yaraQA issue ID, or rules that should pass YARA-Forge QA.
---

# YARA Rule Authoring and Review

Version 2.0. This skill turns four sources into working practice:

| Source | Governs | Details |
|--------|---------|---------|
| [YARA Style Guide](https://github.com/Neo23x0/YARA-Style-Guide) | Rule names, metadata, string groups, condition layout | [references/style.md](references/style.md) |
| [YARA Performance Guidelines](https://github.com/Neo23x0/YARA-Performance-Guidelines) (rev. 1.6) | Atoms, regex, condition order, modules | [references/performance.md](references/performance.md) |
| [yaraQA](https://github.com/Neo23x0/yaraQA) | Automated checks with IDs (`PA2`, `SM4`, `CE1`, ...) | [references/yaraqa-checks.md](references/yaraqa-checks.md) |
| [YARA-Forge](https://github.com/YARAHQ/yara-forge) | Compile gates, quality score, package tiers | [references/yara-forge.md](references/yara-forge.md) |

Guideline items that no tool checks have their own IDs in [references/issue-identifiers.md](references/issue-identifiers.md).

## How YARA spends its time

Most guidance below follows from the scan model:

1. **Compile:** YARA extracts **atoms** (substrings of up to 4 bytes) from every string.
2. **Search:** one Aho-Corasick pass looks for all atoms of all rules.
3. **Verify:** each atom hit is expanded to a full string match. Regex runs only here.
4. **Condition:** evaluated left to right, stopping at the first decisive result.

What follows from it:

- String choice is the main cost. A condition cannot stop a string from being searched: `filesize < 200 and $slow_regex` is still slow on every file.
- A string without a good atom (shorter than 4 bytes, uniform like `00 00 00 00`, or a regex with no fixed 4-byte run) slows the **whole rule set**, not just its own rule.
- Short-circuit evaluation helps only with condition work. Put cheap checks (`uint16(0)`, `filesize`) before expensive ones (`math.*`, hashes, loops, module fields).

## Workflow: write a new rule

Copy this checklist into your working notes and complete it in order:

```
- [ ] 1. Scope: target samples, file type, disk or memory, specific family or generic trait
- [ ] 2. Category and rule name
- [ ] 3. Strings: 3-7 diverse strings grouped as $x / $s / $a / $fp
- [ ] 4. Condition: header -> filesize -> other limits -> strings -> FP filters -> expensive checks
- [ ] 5. Metadata: description, author, reference, date, hash, score
- [ ] 6. Validate with scripts/validate_rule.py; fix and repeat until clean
- [ ] 7. Self-review against "Quick checks" below