Show HN: AgentSkill – Yara-L-Skill

An Agent Skill that teaches AI coding agents to write, review, tune, and convert YARA-L 2.0 detection rules for Google Security Operations (SecOps, formerly Chronicle).

Works with Claude Code, Claude.ai, GitHub Copilot, OpenAI Codex, Gemini CLI, Cursor, and any client that reads the SKILL.md format.

Give your agent a threat description, an ATT&CK technique, a Sigma rule, or an SPL/KQL query. It returns:

It also ships an offline linter that catches the mistakes the Rules Editor would reject.

Write a YARA-L rule for 10 failed logins followed by a success within 30 minutes. Convert this Sigma rule to YARA-L: <paste> Review this YARA-L rule for performance and false positives: <paste> Detect OAuth device code sign ins from Entra ID for users outside an approved list.

Install

Copy the skills/yara-l-authoring folder to your agent's skill directory.

git clone https://github.com/ajaynyayapathi/yara-l-skill.git cp -r yara-l-skill/skills/yara-l-authoring ~/.claude/skills/

For Claude.ai, zip the yara-l-authoring folder and upload it as a custom skill.

skills/yara-l-authoring/ SKILL.md Instructions the agent loads references/ syntax.md Sections, operators, functions, lists, data tables udm-fields.md High use UDM fields by detection category tuning-checklist.md Pre submit review for performance and false positives examples/ 01_single_event_certutil_download.yaral 02_sequence_bruteforce_then_success.yaral 03_absence_edr_sensor_offline.yaral 04_data_table_device_code_signin.yaral scripts/ lint_rule.py Offline structural linter (Python 3, no dependencies)

Linter

python3 skills/yara-l-authoring/scripts/lint_rule.py my_rule.yaral

It checks:

A clean lint result does not mean the rule compiles. Always validate in the SecOps Rules Editor or through the SecOps API before enabling a rule.

UDM field population varies by parser. Rules mark uncertain fields with // VERIFY:.

Example rules use placeholder product names and table names. Replace them before you deploy.

New rules should run with alerting off for 7 days while you review detection volume.

Contributing

Pull requests welcome for new example rules, UDM field corrections, and linter checks. Each new example needs a should fire and a should not fire case in its header comment and must pass the linter.

YARA-L, Google Security Operations, and Chronicle are trademarks of Google LLC. This project is not affiliated with or endorsed by Google.