yara-rule-authoring

Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.

Agent Skill from trailofbits/skills

Copilot Studio

Passes documented load rules

No documented load rule failed.

Microsoft 365 Copilot Preview, Frontier tenants only

Needs changes

Fails: Instructions are under 20,000 characters (M365-INSTRUCTIONS)
instructions are 24,249 characters
rule · Microsoft 365 Copilot: What is a skill
Fails: Every file has a supported file type (M365-FILE-TYPES)
8 unsupported: assets/trail-of-bits-mark.svg, examples/MAL_Mac_ProtonRAT_Jan25.yar, examples/MAL_NPM_SupplyChain_Jan25.yar, examples/MAL_Win_Remcos_Jan25.yar, examples/SUSP_CRX_SuspiciousPermissions.yar, examples/SUSP_JS_Obfuscation_Jan25.yar, scripts/pyproject.toml, scripts/uv.lock
rule · Microsoft 365 Copilot: Supported file and script types

Warnings (don't change the verdict):

Warning: No sign of network access, package installs or authenticated calls (M365-SANDBOX)
SKILL.md mentions JS HTTP client, system package install
rule · Microsoft 365 Copilot: Script execution sandbox
Warning: No sign of network access, package installs or authenticated calls (M365-SANDBOX)
declares dependencies (scripts/pyproject.toml); the sandbox can't install packages
rule · Microsoft 365 Copilot: Script execution sandbox

An agent can have at most 8 skills. Custom skills aren't available in tenants that use Microsoft Purview Information Barriers.

Compatible isn't the same as safe. These verdicts only say whether a skill's files follow Microsoft's documented load rules. The checker reads files and never runs them, and it doesn't review what a skill or its scripts actually do. Read a skill's instructions and scripts before you add it to an agent.

Standards signals

Meets the agentskills.io required fields.

Frontmatter	Present and parsed Spec: frontmatter
name	Meets the spec (1-64 chars, a-z 0-9 hyphens) Spec: name
description	Present, 1-1,024 characters Spec: description
compatibility	Absent or under 500 characters Spec: compatibility
Name matches folder	Yes (`yara-rule-authoring`) Spec: name

Observed from the public SKILL.md at the commit above on 2026-10-24. Not a certification: AAIF and the Agent Skills project don't certify skills. Validate your own skill with skills-ref validate.

Source repo	trailofbits/skills
Path	plugins/yara-authoring/skills/yara-rule-authoring/SKILL.md
Commit checked	`196a9073ab10`
Repo license	CC · we list metadata only
Files	22
Scripts	5 (5 scanned for the sandbox heuristic)
Instructions	24,249 characters
Deepest folder	1 below the skill folder
Rules version	2026-10-22

Re-check the latest version How skill checks work

Is this wrong or out of date? Email us. Skills data built 2026-10-24; rules as of 2026-10-22.

Rule-based checks of public files against Microsoft's documented load rules, not tested in Copilot Studio or Microsoft 365 Copilot. Independent project, not affiliated with Microsoft.