# Pass flags and configuration Run the command you need with arguments, files, environment variables and stdin. ## 1. Inspect the tool’s commands Open its [tool page](https://www.security.run/docs/tools.html) or call `GET /v1/tools/{tool_id}`. Choose an installed command from `operations[].entrypoints` and put that alias in `invocation.executable`. ## 2. Translate your command into an argument list For `yara -s rules.yar sample.bin`, send `["-s","rules.yar","sample.bin"]` in `args`. Each argument is one array item. Shell pipes, `&&`, wildcard expansion and redirection are not interpreted. Request an output file with the tool’s own output flag instead. ## 3. Stage files at the paths used by your command Upload rules, configuration and data, then map their artifact IDs to relative paths. Set `working_directory` if you want the command to start in a subdirectory. Keep `outputs` relative to the workspace root. ## 4. Add environment or stdin when needed Use `environment` for caller variables. Upload stdin bytes as an artifact and set `stdin_artifact_id`. These are separate from command-line arguments. ## 5. Set time and exit-code expectations Choose `timeout_seconds` between 1 and 120. The default is 30. Some security tools return a nonzero code when they find something; consult that tool’s exit-code convention before adding a code to `success_exit_codes`. [Read and save the output](https://www.security.run/docs/visibility.html) after submitting the request. These settings let you use the installed tool normally; the examples are not a list of allowed tasks. ## YARA: arguments and files ```json { "tool": "yara", "timeout_seconds": 30, "invocation": { "executable": "yara", "args": [ "-s", "rules.yar", "sample.txt" ], "files": [ { "path": "rules.yar", "artifact_id": "artifact_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, { "path": "sample.txt", "artifact_id": "artifact_bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" } ] } } ```