菜单
Use when a task needs the local YARA MCP tools `yaraScan`, `yaraScanInline`, `yaraWriteRule`, `yaraListRules`, or `yaraHelp`, including choosing whether to scan with a saved rule file, inline rule text, or persist a rule into the standardized generated-artifact YARA directory.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when a task needs Mandiant capa through the local `runCapa` or `capaHelp` MCP tools, especially when forming a valid capa command string, choosing output mode, or avoiding path-quoting mistakes.
Use when writing, reviewing, or explaining YARA rule syntax, or when preparing `rule_text` for `yaraScanInline` or `yaraWriteRule` so the rule can be saved into the standardized generated-artifact YARA directory.
Use when a task should persist reusable helper files such as Python deobfuscation scripts, Java helpers, reports, or Ghidra-supporting snippets into the standardized agent artifact directory tree.
Use when the task requires emitting a patched binary copy through the local MCP tool lane, especially for short instruction patches or explicit byte replacements.
Use when a task would benefit from a secondary model call through the local MCP tool lane, especially for Hugging Face or OpenAI-compatible inference, decompilation cleanup, classification, or comparing competing interpretations.
Use when a task needs the local `binwalkScan`, `listBinwalkExtraction`, or `binwalkHelp` MCP tools to scan a file for embedded content, optionally extract it, or inspect extraction results.
| name | yara-mcp |
| description | Use when a task needs the local YARA MCP tools `yaraScan`, `yaraScanInline`, `yaraWriteRule`, `yaraListRules`, or `yaraHelp`, including choosing whether to scan with a saved rule file, inline rule text, or persist a rule into the standardized generated-artifact YARA directory. |
Use this skill for structured YARA scanning through the local MCP server.
yaraScan(target_path, rules_path="", recursive=True, show_strings=False, timeout_sec=300)yaraScanInline(target_path, rule_text, recursive=True, show_strings=False, timeout_sec=300)yaraListRules(max_rules=200)yaraWriteRule(rule_text, filename="", overwrite=False, validate=True, timeout_sec=15)yaraHelp(timeout_sec=5)yaraScan when you already have a saved .yar or .yara rule file.yaraScanInline for one-off rule text that should not be persisted.yaraWriteRule when you want to persist a rule into the standardized generated-artifact YARA directory and make it available to default YARA scans.yaraListRules to inspect both the base YARA rules and the generated YARA rules.yaraHelp when you need raw CLI help output.target_path: file or directory to scan.rules_path: optional saved rule file; omit it to use the default combined base-plus-generated rule set.recursive: mainly matters for directory targets.show_strings=True: include string match details when the task needs them.filename: optional simple file name for yaraWriteRule; otherwise the first rule name is used.validate=True: syntax-check the rule before writing when yara is installed.YARA_RULES_DIR.YARA_RULES_DIR is unset, this repo prefers ./third_party/signature-base.MCPServers/yara_rules is only a legacy fallback path.AGENT_ARTIFACT_DIR/yara.yaraWriteRule refreshes index.yar in the generated-rules directory, and default scans include both the base rules and generated rules when rules_path is omitted.