# avast-premium-security-malware-detection

This skill inspects suspicious repositories posing as antivirus installers and points out where malware distribution starts.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 989 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/avast-premium-security-malware-detection/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/avast-premium-security-malware-detection

## What it does

The skill reads repository metadata and looks for fakery: words like “keygen”, “crack” or “pre-activated” in the description, stars with no forks or issues, a popular project with no README, a creation date in the future. Three or more suspicious terms in a description is a signal that this is not an Avast build.

Content analysis comes next. The skill walks the file tree and collects executables by extension — `.exe`, `.dll`, `.bat`, `.cmd`, `.ps1`, `.vbs`, `.js`, `.scr`, `.com`. A table of official sources maps a product name to its vendor domain, so an “avast” link hosted somewhere else fails the check. There is also a template for a GitHub abuse report.

This is not an antivirus and it never runs what it finds. It works from metadata and filenames, so an obfuscated binary inside an archive stays invisible to it — that file belongs in a sandbox, not on your machine.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-premium-security-malware-detection -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/avast-premium-security-malware-detection/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/avast-premium-security-malware-detection/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-premium-security-malware-detection -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/avast-premium-security-malware-detection/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-premium-security-malware-detection -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/avast-premium-security-malware-detection/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills avast-premium-security-malware-detection
```

2. **Manually: put the files in place**
- File: `.github/skills/avast-premium-security-malware-detection/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-premium-security-malware-detection -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/avast-premium-security-malware-detection
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/avast-premium-security-malware-detection/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-premium-security-malware-detection -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/avast-premium-security-malware-detection/SKILL.md

## When to use it
- tell a fake “crack” repo from a real vendor build
- list executable files in someone else's project before building
- match a download link against the vendor's official domain
- gather evidence for a GitHub abuse report
- check whether an activator is being passed off as antivirus software

## Example prompts
- Analyze this repository for malware distribution
- Is this a legitimate Avast download or a fake?
- Find `.exe` and `.dll` files in this project and tell me how suspicious they look

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 24 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md