# avast-premium-security-detection

This skill reviews suspicious repositories that claim to distribute cracked antivirus software. Use it for an initial malware and source-authenticity check.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1100 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/avast-premium-security-detection/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/avast-premium-security-detection

## What it does

The skill examines repositories posing as Avast Premium Security distributions. It looks for piracy language, fake activation claims, unusual repository metadata, weak project documentation, and signs that a supposed software package may be a malware dropper.

Its examples cover several checks: scanning executable content for terms such as `keygen`, `loader`, and `activator`; assigning risk from repository metadata; comparing a file with an official SHA-256 value; and checking whether a download URL uses an official domain. The snippets are in C++. The checksum example uses OpenSSL and `curl`, while the behavior-monitoring section starts with Windows process APIs.

The checksum path depends on OpenSSL, and the behavior-monitoring example is tied to Windows APIs.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-premium-security-detection -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/avast-premium-security-detection/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/avast-premium-security-detection/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-premium-security-detection -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/avast-premium-security-detection/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-premium-security-detection -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/avast-premium-security-detection/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills avast-premium-security-detection
```

2. **Manually: put the files in place**
- File: `.github/skills/avast-premium-security-detection/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-premium-security-detection -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/avast-premium-security-detection
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/avast-premium-security-detection/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-premium-security-detection -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/avast-premium-security-detection/SKILL.md

## When to use it
- review a repository offering a cracked antivirus
- spot keygen and loader indicators in an executable
- score repository risk from metadata and description
- compare a download with an official SHA-256
- check whether a download source uses an official domain

## Example prompts
- Analyze this Avast repository for signs of a malware distribution scheme.
- Check whether this security software repository looks like a piracy scam.
- Scan the file for `keygen`, `loader`, `activator`, PowerShell, and webhook indicators.

## Similar
- [security-webshells](https://affpapa.org/en/nevibecode/skills/security-webshells.md) — skill · 542 installs
- [security-detection-rule-management](https://affpapa.org/en/nevibecode/skills/security-detection-rule-management.md) — skill · 3800 installs
- [analyzing-heap-spray-exploitation](https://affpapa.org/en/nevibecode/skills/analyzing-heap-spray-exploitation.md) — skill · 372 installs
- [detection-engineering-coverage-evaluation](https://affpapa.org/en/nevibecode/skills/detection-engineering-coverage-evaluation.md) — skill · 6394 installs
- [secops-detection-engineering](https://affpapa.org/en/nevibecode/skills/secops-detection-engineering.md) — skill · 1900 installs
- [yourvpndead-vpn-detection](https://affpapa.org/en/nevibecode/skills/yourvpndead-vpn-detection.md) — skill · 472 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md