---
name: thor-maintenance
description: Maintain THOR installs using thor-util: update signatures, upgrade versions, download offline packs, generate reports, manage YARA-Forge. Use when the user asks about updating/upgrading/report generation.
---
# THOR Maintenance Skill

Rules
- Be precise about thor-util verbs:
  - update = signatures
  - upgrade = program + signatures, keep config
  - download = full pack incl config (offline use case)
- Prefer stable signatures; mention sigdev only for urgent cases and explain tradeoffs.

Use these references when needed
- thor-util update vs upgrade vs download: reference/thor-util-update-upgrade.md
- YARA-Forge: reference/yara-forge.md
- Offline updates: reference/offline-updates.md

Output format
- Exact thor-util command(s)
- One-line “what it changes”
- One-line “what it does not change”