# SkillSpector YARA Signature Rules for Malware Detection: A Complete Guide

> Explore SkillSpector YARA signature rules for robust malware detection. Understand how this NVIDIA tool identifies reverse shells, ransomware, cryptominers, and more.

- Repository: [NVIDIA Corporation/SkillSpector](https://github.com/NVIDIA/SkillSpector)
- Tags: how-to-guide
- Published: 2026-06-25

---

**SkillSpector ships with five built-in YARA rule sets located in `src/skillspector/yara_rules/` that automatically compile at runtime to detect reverse shells, ransomware, web shells, cryptominers, and hacking tools.**

NVIDIA's SkillSpector includes a comprehensive collection of YARA signature rules for malware detection that are embedded directly into the repository. These rules cover everything from general malware indicators to language-specific web shells and cryptomining code. The built-in rules are automatically loaded by the `static_yara` analyzer and can be extended with custom rule directories via command-line flags.

## Built-in YARA Rule Sets in SkillSpector

SkillSpector organizes its detection logic into five specialized rule files under `src/skillspector/yara_rules/`. Each file targets specific threat categories and is automatically compiled when the analyzer runs.

### malware.yar – General Malware Detection

The `malware.yar` file contains general-purpose malware signatures that identify reverse shells, backdoors, keyloggers, ransomware behavior, command-and-control (C2) frameworks, and information stealers. Key rules include `reverse_shell` and `ransomware_behavior`, which use pattern matching to flag suspicious code constructs. These rules serve as the first line of defense against common malware families.

### webshells.yar – Web Shell Detection

The `webshells.yar` rule set detects malicious web shells written in PHP, Python, JSP, ASPX, and other server-side languages. Notable rules include `php_webshell_generic` and `python_webshell`, which identify obfuscated upload handlers and command execution wrappers often planted by attackers on compromised web servers.

### hacktools.yar – Hacking Utility Signatures

The `hacktools.yar` file contains patterns that match common penetration testing and hacking utilities. The `nmap_scanner` rule identifies embedded port scanning logic, while other signatures detect password crackers and network reconnaissance tools that might be included in malicious agent skills.

### cryptominers.yar – Cryptomining Code Detection

The `cryptominers.yar` rules target unauthorized cryptomining operations embedded in scripts or binaries. The `crypto_miner_generic` rule identifies mining pool connection strings, cryptocurrency wallet addresses, and hash calculation routines that indicate resource hijacking.

### agent_skills.yar – Unsafe Agent Skill Patterns

The `agent_skills.yar` file focuses on malicious or undesired agent-skill artifacts, including self-modifying code and unsafe import patterns. The `unsafe_import` rule flags dynamic code loading techniques that could enable arbitrary code execution in AI agent environments.

## How SkillSpector Loads YARA Signature Rules

The rule compilation and loading logic resides in [`src/skillspector/nodes/analyzers/static_yara.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_yara.py). The analyzer defines a built-in rules directory constant and automatically discovers all `.yar` and `.yara` files.

```python

# src/skillspector/nodes/analyzers/static_yara.py

_BUILTIN_RULES_DIR = Path(__file__).resolve().parent.parent.parent / "yara_rules"
_RULE_EXTENSIONS = ("*.yar", "*.yara")
...
def _load_rules(extra_dir: Path | None = None) -> yara.Rules | None:
    """Compile built‑in rules together with any extra user‑provided directory."""
    dirs = [_BUILTIN_RULES_DIR]
    if extra_dir:
        dirs.append(extra_dir)
    # collect .yar/.yara files, build namespace map, then compile

```

When `_load_rules()` executes, it collects all matching rule files from the built-in directory and any user-specified extra directory, compiles them into a single YARA rules object, and returns it for scanning operations.

## Running Scans with Built-in YARA Rules

To execute a scan using the default YARA signature rules, run the SkillSpector CLI without additional flags:

```bash
skill-spector scan /path/to/project \
    --format sarif \
    --output results.sarif

```

This command automatically loads all built-in rules from `src/skillspector/yara_rules/` and outputs findings in SARIF format. Each match generates an `AnalyzerFinding` object containing the rule ID, severity, confidence, and descriptive metadata extracted from the rule's `meta` fields.

## Extending Detection with Custom YARA Rules

You can supplement the built-in YARA signature rules with custom rule directories using the `--yara-rules-dir` flag:

```bash
skill-spector scan /path/to/project \
    --yara-rules-dir ./my_custom_yara \
    --format sarif \
    --output results.sarif

```

SkillSpector merges custom `.yar` and `.yara` files with the built-in set, allowing you to evaluate organization-specific malware signatures alongside the default detection patterns.

## Accessing YARA Findings Programmatically

For integration into custom pipelines, you can invoke the YARA analyzer directly:

```python
from skillspector.nodes.analyzers import static_yara

state = {
    "components": [],               # files to scan

    "file_cache": {},               # internal cache

    "yara_rules_dir": None,         # optional extra dir

}
findings = static_yara.node(state)["findings"]
for f in findings:
    print(f"Rule: {f.id} – Severity: {f.severity} – Message: {f.message}")

```

Each finding object exposes the rule identifier (`f.id`), severity level, confidence score, and human-readable message constructed from the YARA rule's metadata.

## Summary

- SkillSpector includes **five built-in YARA rule files** under `src/skillspector/yara_rules/` covering malware, web shells, hack tools, cryptominers, and unsafe agent patterns.
- The `static_yara` analyzer automatically compiles these rules at runtime using the `_load_rules()` function in [`static_yara.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_yara.py).
- Detection covers **reverse shells, ransomware, PHP/Python web shells, port scanners, and cryptomining code**.
- Users can extend detection by passing `--yara-rules-dir` to include custom rule directories.
- Findings are emitted as **`AnalyzerFinding`** objects with SARIF-compatible output containing rule metadata.

## Frequently Asked Questions

### What types of malware can SkillSpector detect with its built-in YARA rules?

SkillSpector's built-in YARA signature rules detect reverse shells, backdoors, keyloggers, ransomware behavior, command-and-control frameworks, information stealers, web shells in multiple languages, hacking utilities like port scanners, and unauthorized cryptomining code. The rules also identify unsafe coding patterns specific to AI agent skills that could enable code injection.

### How do I add custom YARA rules to a SkillSpector scan?

Use the `--yara-rules-dir` command-line flag to specify a directory containing your custom `.yar` or `.yara` files. SkillSpector automatically merges these with the built-in rules located in `src/skillspector/yara_rules/` during the compilation phase handled by `_load_rules()` in [`static_yara.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_yara.py).

### Where are the default YARA rules stored in the SkillSpector repository?

The default YARA signature rules are stored in the `src/skillspector/yara_rules/` directory and include `malware.yar`, `webshells.yar`, `hacktools.yar`, `cryptominers.yar`, and `agent_skills.yar`. The analyzer references this location via the `_BUILTIN_RULES_DIR` constant in [`src/skillspector/nodes/analyzers/static_yara.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_yara.py).

### What output format does SkillSpector use for YARA detection results?

SkillSpector converts YARA matches into `AnalyzerFinding` objects and can output them in **SARIF** (Static Analysis Results Interchange Format). Each finding includes the rule ID, severity, confidence level, and descriptive message extracted from the rule's `meta` fields.