ClawHub
Back to skill

Security audit

Yara Authoring

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Markdown-only guide for writing YARA-X detection rules, and the scanner match is explained by illustrative malware-detection examples rather than an embedded payload.

Install only if you want Codex guidance for writing YARA-X malware-detection rules. The examples may include malware-family names and detection strings, but they are documentation snippets, not executable code; still review any generated YARA rules before using them on sensitive or large file sets.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

$api2 = "WriteProcessMemory" ascii $str1 = { 48 8B 05 ?? ?? ?? ?? 48 85 C0 } // hex with wildcards $pdb = /[A-Z]:\.\Release\..pdb/ nocase

text
condition:
    uint16(0) == 0x5A4D and
    filesize < 5MB and
    (2 of ($api*) and $str1) or
    $pdb

}

text

## Naming Convention

`Family_Variant_Technique` — examples:
- `Emotet_Loader_DocumentMacro`
- `CobaltStrike_Beacon_x64`
- `Generic_Cryptominer_XMRig`

## String Selection

**Good strings (unique, specific):**
- Mutex names, PDB paths, C2 URLs
- Unique byte sequences from disassembly
- Custom encryption constants
- Uncommon API call sequences

**Bad strings (too common, high FP):**
- `http://`, `https://`, common API names alone
- Single common words, short strings (<4 bytes)
- Strings found in Windows system files

## Condition Patterns

```yara
// Performance-ordered (cheap → expensive)
condition:
    uint16(0) == 0x5A4D and     // Magic bytes (instant)
    filesize < 10MB and

Static analysis

No suspicious patterns detected.