{"owner":"mandiant","repo":"capa","hasSkills":true,"totalSkillsCount":3,"totalTokensCount":810,"categories":["plugin-manifest","root-instruction","anthropic-skill"],"hasMcp":false,"mcpConfig":null,"found":["capa/ida/plugin/ida-plugin.json","doc/rules.md","web/rules/README.md"],"skills":{"capa/ida/plugin/ida-plugin.json":"{\n  \"IDAMetadataDescriptorVersion\": 1,\n  \"plugin\": {\n    \"name\": \"capa\",\n    \"entryPoint\": \"capa_explorer.py\",\n    \"version\": \"10.0.0\",\n    \"idaVersions\": \">=7.4\",\n    \"description\": \"Identify capabilities in executable files using FLARE's capa framework\",\n    \"license\": \"Apache-2.0\",\n    \"categories\": [\n      \"malware-analysis\",\n      \"api-scripting-and-automation\",\n      \"ui-ux-and-visualization\"\n    ],\n    \"pythonDependencies\": [\"flare-capa==10.0.0\"],\n    \"urls\": {\n      \"repository\": \"https://github.com/mandiant/capa\"\n    },\n    \"authors\": [\n      {\"name\": \"Willi Ballenthin\", \"email\": \"wballenthin@hex-rays.com\"},\n      {\"name\": \"Moritz Raabe\", \"email\": \"moritzraabe@google.com\"},\n      {\"name\": \"Mike Hunhoff\", \"email\": \"mike.hunhoff@gmail.com\"},\n      {\"name\": \"Yacine Elhamer\", \"email\": \"elhamer.yacine@gmail.com\"}\n    ],\n    \"keywords\": [\n      \"capability-detection\",\n      \"malware-analysis\",\n      \"behavior-analysis\",\n      \"reverse-engineering\",\n      \"att&ck\",\n      \"rule-engine\",\n      \"feature-extraction\",\n      \"yara-like-rules\",\n      \"static-analysis\",\n      \"dynamic-analysis\"\n    ]\n  }\n}\n","doc/rules.md":"### rules\n\ncapa uses a collection of rules to identify capabilities within a program.\nThe [github.com/mandiant/capa-rules](https://github.com/mandiant/capa-rules) repository contains hundreds of standard library rules that are distributed with capa.\n\nWhen you download a standalone version of capa, this standard library is embedded within the executable and capa will use these rules by default:\n\n```console\n$ capa suspicious.exe\n```\n\nHowever, you may want to modify the rules for a variety of reasons:\n\n  - develop new rules to find behaviors,\n  - tweak existing rules to reduce false positives,\n  - collect a private selection of rules not shared publicly.\n\nOr, you may want to use capa as a Python library within another application.\n\nIn these scenarios, you must provide the rule set to capa as a directory on your file system. Do this using the `-r`/`--rules` parameter:\n\n```console\n$ capa --rules /local/path/to/rules suspicious.exe\n```\n\nYou can download the standard set of rules as ZIP or TGZ archives from the [capa-rules release page](https://github.com/mandiant/capa-rules/releases).\n\nNote that you must use match the rules major version with the capa major version, i.e., use `v1` rules with `v1` of capa.\nThis is so that new versions of capa can update rule syntax, such as by adding new fields and logic.\n\nOtherwise, using rules with a mismatched version of capa may lead to errors like:\n\n```\n$ capa --rules /path/to/mismatched/rules suspicious.exe\nERROR:lint:invalid rule: injection.yml: invalid rule: unexpected statement: instruction\n```                \n\nYou can check the version of capa you're currently using like this:\n                         \n```console\n$ capa --version\ncapa 10.0.0\n```\n","web/rules/README.md":"# capa rules documentation website\n\n## requirements\n\n  - [just](https://github.com/casey/just)\n  - [pagefind](https://pagefind.app/)\n  - `pip install -r requirements`\n\n## building\n\n```\njust clean\njust build\n````\n\nthen `just serve` and visit http://127.0.0.1:8000/ or (upload `./public` somewhere).\n"},"files":{"capa/ida/plugin/ida-plugin.json":"{\n  \"IDAMetadataDescriptorVersion\": 1,\n  \"plugin\": {\n    \"name\": \"capa\",\n    \"entryPoint\": \"capa_explorer.py\",\n    \"version\": \"10.0.0\",\n    \"idaVersions\": \">=7.4\",\n    \"description\": \"Identify capabilities in executable files using FLARE's capa framework\",\n    \"license\": \"Apache-2.0\",\n    \"categories\": [\n      \"malware-analysis\",\n      \"api-scripting-and-automation\",\n      \"ui-ux-and-visualization\"\n    ],\n    \"pythonDependencies\": [\"flare-capa==10.0.0\"],\n    \"urls\": {\n      \"repository\": \"https://github.com/mandiant/capa\"\n    },\n    \"authors\": [\n      {\"name\": \"Willi Ballenthin\", \"email\": \"wballenthin@hex-rays.com\"},\n      {\"name\": \"Moritz Raabe\", \"email\": \"moritzraabe@google.com\"},\n      {\"name\": \"Mike Hunhoff\", \"email\": \"mike.hunhoff@gmail.com\"},\n      {\"name\": \"Yacine Elhamer\", \"email\": \"elhamer.yacine@gmail.com\"}\n    ],\n    \"keywords\": [\n      \"capability-detection\",\n      \"malware-analysis\",\n      \"behavior-analysis\",\n      \"reverse-engineering\",\n      \"att&ck\",\n      \"rule-engine\",\n      \"feature-extraction\",\n      \"yara-like-rules\",\n      \"static-analysis\",\n      \"dynamic-analysis\"\n    ]\n  }\n}\n","doc/rules.md":"### rules\n\ncapa uses a collection of rules to identify capabilities within a program.\nThe [github.com/mandiant/capa-rules](https://github.com/mandiant/capa-rules) repository contains hundreds of standard library rules that are distributed with capa.\n\nWhen you download a standalone version of capa, this standard library is embedded within the executable and capa will use these rules by default:\n\n```console\n$ capa suspicious.exe\n```\n\nHowever, you may want to modify the rules for a variety of reasons:\n\n  - develop new rules to find behaviors,\n  - tweak existing rules to reduce false positives,\n  - collect a private selection of rules not shared publicly.\n\nOr, you may want to use capa as a Python library within another application.\n\nIn these scenarios, you must provide the rule set to capa as a directory on your file system. Do this using the `-r`/`--rules` parameter:\n\n```console\n$ capa --rules /local/path/to/rules suspicious.exe\n```\n\nYou can download the standard set of rules as ZIP or TGZ archives from the [capa-rules release page](https://github.com/mandiant/capa-rules/releases).\n\nNote that you must use match the rules major version with the capa major version, i.e., use `v1` rules with `v1` of capa.\nThis is so that new versions of capa can update rule syntax, such as by adding new fields and logic.\n\nOtherwise, using rules with a mismatched version of capa may lead to errors like:\n\n```\n$ capa --rules /path/to/mismatched/rules suspicious.exe\nERROR:lint:invalid rule: injection.yml: invalid rule: unexpected statement: instruction\n```                \n\nYou can check the version of capa you're currently using like this:\n                         \n```console\n$ capa --version\ncapa 10.0.0\n```\n","web/rules/README.md":"# capa rules documentation website\n\n## requirements\n\n  - [just](https://github.com/casey/just)\n  - [pagefind](https://pagefind.app/)\n  - `pip install -r requirements`\n\n## building\n\n```\njust clean\njust build\n````\n\nthen `just serve` and visit http://127.0.0.1:8000/ or (upload `./public` somewhere).\n"},"items":[{"name":"rules.md","path":"doc/rules.md","rawUrl":"https://raw.githubusercontent.com/mandiant/capa/HEAD/doc/rules.md","title":"doc - Development & Architecture Rules","category":"root-instruction","format":"markdown","content":"### rules\n\ncapa uses a collection of rules to identify capabilities within a program.\nThe [github.com/mandiant/capa-rules](https://github.com/mandiant/capa-rules) repository contains hundreds of standard library rules that are distributed with capa.\n\nWhen you download a standalone version of capa, this standard library is embedded within the executable and capa will use these rules by default:\n\n```console\n$ capa suspicious.exe\n```\n\nHowever, you may want to modify the rules for a variety of reasons:\n\n  - develop new rules to find behaviors,\n  - tweak existing rules to reduce false positives,\n  - collect a private selection of rules not shared publicly.\n\nOr, you may want to use capa as a Python library within another application.\n\nIn these scenarios, you must provide the rule set to capa as a directory on your file system. Do this using the `-r`/`--rules` parameter:\n\n```console\n$ capa --rules /local/path/to/rules suspicious.exe\n```\n\nYou can download the standard set of rules as ZIP or TGZ archives from the [capa-rules release page](https://github.com/mandiant/capa-rules/releases).\n\nNote that you must use match the rules major version with the capa major version, i.e., use `v1` rules with `v1` of capa.\nThis is so that new versions of capa can update rule syntax, such as by adding new fields and logic.\n\nOtherwise, using rules with a mismatched version of capa may lead to errors like:\n\n```\n$ capa --rules /path/to/mismatched/rules suspicious.exe\nERROR:lint:invalid rule: injection.yml: invalid rule: unexpected statement: instruction\n```                \n\nYou can check the version of capa you're currently using like this:\n                         \n```console\n$ capa --version\ncapa 10.0.0\n```\n","isInternal":false,"tokens":396,"sizeBytes":1711},{"name":"README.md","path":"web/rules/README.md","rawUrl":"https://raw.githubusercontent.com/mandiant/capa/HEAD/web/rules/README.md","title":"Rules Skill","category":"anthropic-skill","format":"markdown","content":"# capa rules documentation website\n\n## requirements\n\n  - [just](https://github.com/casey/just)\n  - [pagefind](https://pagefind.app/)\n  - `pip install -r requirements`\n\n## building\n\n```\njust clean\njust build\n````\n\nthen `just serve` and visit http://127.0.0.1:8000/ or (upload `./public` somewhere).\n","isInternal":false,"tokens":89,"sizeBytes":298},{"name":"ida-plugin.json","path":"capa/ida/plugin/ida-plugin.json","rawUrl":"https://raw.githubusercontent.com/mandiant/capa/HEAD/capa/ida/plugin/ida-plugin.json","title":"plugin Plugin Manifest","category":"plugin-manifest","format":"json","content":"{\n  \"IDAMetadataDescriptorVersion\": 1,\n  \"plugin\": {\n    \"name\": \"capa\",\n    \"entryPoint\": \"capa_explorer.py\",\n    \"version\": \"10.0.0\",\n    \"idaVersions\": \">=7.4\",\n    \"description\": \"Identify capabilities in executable files using FLARE's capa framework\",\n    \"license\": \"Apache-2.0\",\n    \"categories\": [\n      \"malware-analysis\",\n      \"api-scripting-and-automation\",\n      \"ui-ux-and-visualization\"\n    ],\n    \"pythonDependencies\": [\"flare-capa==10.0.0\"],\n    \"urls\": {\n      \"repository\": \"https://github.com/mandiant/capa\"\n    },\n    \"authors\": [\n      {\"name\": \"Willi Ballenthin\", \"email\": \"wballenthin@hex-rays.com\"},\n      {\"name\": \"Moritz Raabe\", \"email\": \"moritzraabe@google.com\"},\n      {\"name\": \"Mike Hunhoff\", \"email\": \"mike.hunhoff@gmail.com\"},\n      {\"name\": \"Yacine Elhamer\", \"email\": \"elhamer.yacine@gmail.com\"}\n    ],\n    \"keywords\": [\n      \"capability-detection\",\n      \"malware-analysis\",\n      \"behavior-analysis\",\n      \"reverse-engineering\",\n      \"att&ck\",\n      \"rule-engine\",\n      \"feature-extraction\",\n      \"yara-like-rules\",\n      \"static-analysis\",\n      \"dynamic-analysis\"\n    ]\n  }\n}\n","frontmatter":{"IDAMetadataDescriptorVersion":1,"plugin":{"name":"capa","entryPoint":"capa_explorer.py","version":"10.0.0","idaVersions":">=7.4","description":"Identify capabilities in executable files using FLARE's capa framework","license":"Apache-2.0","categories":["malware-analysis","api-scripting-and-automation","ui-ux-and-visualization"],"pythonDependencies":["flare-capa==10.0.0"],"urls":{"repository":"https://github.com/mandiant/capa"},"authors":[{"name":"Willi Ballenthin","email":"wballenthin@hex-rays.com"},{"name":"Moritz Raabe","email":"moritzraabe@google.com"},{"name":"Mike Hunhoff","email":"mike.hunhoff@gmail.com"},{"name":"Yacine Elhamer","email":"elhamer.yacine@gmail.com"}],"keywords":["capability-detection","malware-analysis","behavior-analysis","reverse-engineering","att&ck","rule-engine","feature-extraction","yara-like-rules","static-analysis","dynamic-analysis"]}},"isInternal":false,"tokens":325,"sizeBytes":1118}],"systemPromptSnippet":"<yakaai_skills repo=\"mandiant/capa\">\n<!-- File: doc/rules.md (Tokens: ~396 | Category: root-instruction) -->\n### rules\n\ncapa uses a collection of rules to identify capabilities within a program.\nThe [github.com/mandiant/capa-rules](https://github.com/mandiant/capa-rules) repository contains hundreds of standard library rules that are distributed with capa.\n\nWhen you download a standalone version of capa, this standard library is embedded within the executable and capa will use these rules by default:\n\n```console\n$ capa suspicious.exe\n```\n\nHowever, you may want to modify the rules for a variety of reasons:\n\n  - develop new rules to find behaviors,\n  - tweak existing rules to reduce false positives,\n  - collect a private selection of rules not shared publicly.\n\nOr, you may want to use capa as a Python library within another application.\n\nIn these scenarios, you must provide the rule set to capa as a directory on your file system. Do this using the `-r`/`--rules` parameter:\n\n```console\n$ capa --rules /local/path/to/rules suspicious.exe\n```\n\nYou can download the standard set of rules as ZIP or TGZ archives from the [capa-rules release page](https://github.com/mandiant/capa-rules/releases).\n\nNote that you must use match the rules major version with the capa major version, i.e., use `v1` rules with `v1` of capa.\nThis is so that new versions of capa can update rule syntax, such as by adding new fields and logic.\n\nOtherwise, using rules with a mismatched version of capa may lead to errors like:\n\n```\n$ capa --rules /path/to/mismatched/rules suspicious.exe\nERROR:lint:invalid rule: injection.yml: invalid rule: unexpected statement: instruction\n```                \n\nYou can check the version of capa you're currently using like this:\n                         \n```console\n$ capa --version\ncapa 10.0.0\n```\n\n<!-- File: web/rules/README.md (Tokens: ~89 | Category: anthropic-skill) -->\n# capa rules documentation website\n\n## requirements\n\n  - [just](https://github.com/casey/just)\n  - [pagefind](https://pagefind.app/)\n  - `pip install -r requirements`\n\n## building\n\n```\njust clean\njust build\n````\n\nthen `just serve` and visit http://127.0.0.1:8000/ or (upload `./public` somewhere).\n\n<!-- File: capa/ida/plugin/ida-plugin.json (Tokens: ~325 | Category: plugin-manifest) -->\n{\n  \"IDAMetadataDescriptorVersion\": 1,\n  \"plugin\": {\n    \"name\": \"capa\",\n    \"entryPoint\": \"capa_explorer.py\",\n    \"version\": \"10.0.0\",\n    \"idaVersions\": \">=7.4\",\n    \"description\": \"Identify capabilities in executable files using FLARE's capa framework\",\n    \"license\": \"Apache-2.0\",\n    \"categories\": [\n      \"malware-analysis\",\n      \"api-scripting-and-automation\",\n      \"ui-ux-and-visualization\"\n    ],\n    \"pythonDependencies\": [\"flare-capa==10.0.0\"],\n    \"urls\": {\n      \"repository\": \"https://github.com/mandiant/capa\"\n    },\n    \"authors\": [\n      {\"name\": \"Willi Ballenthin\", \"email\": \"wballenthin@hex-rays.com\"},\n      {\"name\": \"Moritz Raabe\", \"email\": \"moritzraabe@google.com\"},\n      {\"name\": \"Mike Hunhoff\", \"email\": \"mike.hunhoff@gmail.com\"},\n      {\"name\": \"Yacine Elhamer\", \"email\": \"elhamer.yacine@gmail.com\"}\n    ],\n    \"keywords\": [\n      \"capability-detection\",\n      \"malware-analysis\",\n      \"behavior-analysis\",\n      \"reverse-engineering\",\n      \"att&ck\",\n      \"rule-engine\",\n      \"feature-extraction\",\n      \"yara-like-rules\",\n      \"static-analysis\",\n      \"dynamic-analysis\"\n    ]\n  }\n}\n</yakaai_skills>"}