avast-security-awareness — Claude Code skill: spot fake repos
Trains your agent to flag repositories posing as antivirus tools or cracked software, and to warn you before anything gets downloaded.
npx skills add reason-machines/security-skills --skill avast-security-awareness -a claude-codeWhat avast-security-awareness does
The skill gives an agent a checklist for spotting malware distribution sites dressed up as legitimate security tools. It looks for suspicious words in the description (keygen, crack, pre-activated, loader, serial), checks whether the README is long enough to be real, catches claims of premium software offered for free, and compares a claimed version against the current date. Each hit produces a warning plus an official vendor source instead of the repo link.
It also ships a response template: what not to do (clone, run files, enter credentials) and where to report the repository. There are examples for verifying a signature with signtool verify /pa /v and checking a hash with sha256sum against the vendor's published checksum. Scanning thresholds live in environment variables: MALWARE_SCAN_ENABLED, REPO_VERIFICATION_LEVEL, WARN_ON_MISSING_README, BLOCK_KEYGEN_KEYWORDS.
This is not an antivirus and it does not inspect binaries. It works on descriptions and repository files, so a short or missing README triggers a warning while real malware with convincing docs slips through. If your team pulls utilities and dependencies straight from GitHub, that gap is worth knowing about before you treat the warning as a verdict.
What it helps with
- tell a fake antivirus repository from a real one
- warn a developer before they download files from a shady source
- teach an agent to catch keygen and crack wording in a description
- explain the risk of running cracked builds of paid software
- point to the vendor's official site instead of a repo link
Example prompts for the agent
- check this repository for malware distribution patterns
- is this avast repository legitimate or a scam?
- what are the red flags in repos offering keygen and pre-activated software
How to install avast-security-awareness
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill avast-security-awareness -a claude-code2Manually: put the files in place
~/.claude/skills/avast-security-awareness/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/avast-security-awareness/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill avast-security-awareness -a codex2Manually: put the files in place
.agents/skills/avast-security-awareness/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill avast-security-awareness -a cursor2Manually: put the files in place
.cursor/skills/avast-security-awareness/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install reason-machines/security-skills avast-security-awareness2Manually: put the files in place
.github/skills/avast-security-awareness/SKILL.md1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill avast-security-awareness -a gemini-cli2Platform CLI
gemini skills install https://github.com/reason-machines/security-skills --path skills/avast-security-awarenessManually: put the files in place
.devin/skills/avast-security-awareness/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill avast-security-awareness -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about avast-security-awareness
How do I install avast-security-awareness in Claude?
Run npx skills add reason-machines/security-skills --skill avast-security-awareness -a claude-code. The skill file then lands at ~/.claude/skills/avast-security-awareness/SKILL.md.
What does avast-security-awareness do?
It teaches an agent to recognize repositories disguised as legitimate security tools and to answer with a warning plus a safe alternative. Detection runs on the description, the README and keywords such as keygen or loader.
Does the skill scan downloaded files itself?
No. It reads repository descriptions and docs, and hands you signtool verify /pa /v and sha256sum when you want to check a signature or hash yourself.
