# avast-premium-security-analysis

A skill for studying Avast Premium Security components and antivirus protection mechanisms. Useful when you take apart defensive software inside an isolated environment.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1100 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/avast-premium-security-analysis/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/avast-premium-security-analysis

## What it does

The skill hands your agent context on Avast Premium Security internals: the engine, the behavior shield, and how file operations get intercepted. It ships C++ examples for Windows — watching a directory with `ReadDirectoryChangesW`, matching files against signatures, observing process injection. There is also a section on spotting pirated builds and a list of legitimate sources such as ClamAV and YARA.

Run this in an isolated virtual machine only. The skill states plainly that production systems are off limits, because poking at antivirus hooks and samples can take down the machine you are protecting. Building the examples needs Windows and a C++ compiler; parts of the code lean on `windows.h` and `MpClient.h`.

The warning about repos offering keygens and pre-activated builds is the part worth reading twice. A cracked antivirus opens the door to exactly what you installed it against. That is a good reason to check where your samples come from.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-premium-security-analysis -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/avast-premium-security-analysis/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/avast-premium-security-analysis/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-premium-security-analysis -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/avast-premium-security-analysis/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-premium-security-analysis -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/avast-premium-security-analysis/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills avast-premium-security-analysis
```

2. **Manually: put the files in place**
- File: `.github/skills/avast-premium-security-analysis/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-premium-security-analysis -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/avast-premium-security-analysis
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/avast-premium-security-analysis/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-premium-security-analysis -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/avast-premium-security-analysis/SKILL.md

## When to use it
- trace how an antivirus intercepts file operations
- write directory monitoring with `ReadDirectoryChangesW`
- tell a legitimate security repo from one shipping a keygen
- set up an isolated VM for sample analysis
- build a basic signature scanner for files

## Example prompts
- show me how the behavior shield works in Avast Premium Security
- help me write directory monitoring with `ReadDirectoryChangesW` for a learning scanner
- what signs give away a repo with a pirated antivirus build

## Similar
- [ntwarden-windows-analysis-toolkit](https://affpapa.org/en/nevibecode/skills/ntwarden-windows-analysis-toolkit.md) — skill · 443 installs
- [security-webshells](https://affpapa.org/en/nevibecode/skills/security-webshells.md) — skill · 539 installs
- [powershell-security-hardening](https://affpapa.org/en/nevibecode/agents/powershell-security-hardening.md) — subagent · 194 installs
- [analyzing-malware-persistence-with-autoruns](https://affpapa.org/en/nevibecode/skills/analyzing-malware-persistence-with-autoruns.md) — skill · 356 installs
- [windows-av-evasion](https://affpapa.org/en/nevibecode/skills/windows-av-evasion.md) — skill · 3600 installs
- [windows-lateral-movement](https://affpapa.org/en/nevibecode/skills/windows-lateral-movement.md) — skill · 3500 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 24 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md