# avast-security-awareness

Trains your agent to flag repositories posing as antivirus tools or cracked software, and to warn you before anything gets downloaded.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1100 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/avast-security-awareness/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/avast-security-awareness

## What it does

The skill gives an agent a checklist for spotting malware distribution sites dressed up as legitimate security tools. It looks for suspicious words in the description (keygen, crack, pre-activated, loader, serial), checks whether the README is long enough to be real, catches claims of premium software offered for free, and compares a claimed version against the current date. Each hit produces a warning plus an official vendor source instead of the repo link.

It also ships a response template: what not to do (clone, run files, enter credentials) and where to report the repository. There are examples for verifying a signature with `signtool verify /pa /v` and checking a hash with `sha256sum` against the vendor's published checksum. Scanning thresholds live in environment variables: `MALWARE_SCAN_ENABLED`, `REPO_VERIFICATION_LEVEL`, `WARN_ON_MISSING_README`, `BLOCK_KEYGEN_KEYWORDS`.

This is not an antivirus and it does not inspect binaries. It works on descriptions and repository files, so a short or missing README triggers a warning while real malware with convincing docs slips through. If your team pulls utilities and dependencies straight from GitHub, that gap is worth knowing about before you treat the warning as a verdict.

## Requirements
- Works with: GitHub

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-security-awareness -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/avast-security-awareness/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/avast-security-awareness/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-security-awareness -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/avast-security-awareness/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-security-awareness -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/avast-security-awareness/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills avast-security-awareness
```

2. **Manually: put the files in place**
- File: `.github/skills/avast-security-awareness/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-security-awareness -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/avast-security-awareness
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/avast-security-awareness/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill avast-security-awareness -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/avast-security-awareness/SKILL.md

## When to use it
- tell a fake antivirus repository from a real one
- warn a developer before they download files from a shady source
- teach an agent to catch keygen and crack wording in a description
- explain the risk of running cracked builds of paid software
- point to the vendor's official site instead of a repo link

## Example prompts
- check this repository for malware distribution patterns
- is this avast repository legitimate or a scam?
- what are the red flags in repos offering keygen and pre-activated software

## Similar
- [saas-security-posture](https://affpapa.org/en/nevibecode/skills/saas-security-posture.md) — skill · 314 installs
- [repo-security-posture](https://affpapa.org/en/nevibecode/skills/repo-security-posture.md) — skill · 853 installs
- [secrets-in-git-history](https://affpapa.org/en/nevibecode/skills/secrets-in-git-history.md) — skill · 1900 installs
- [ci-cd-security](https://affpapa.org/en/nevibecode/skills/ci-cd-security.md) — skill · 7900 installs
- [make-repo-contribution](https://affpapa.org/en/nevibecode/skills/make-repo-contribution.md) — skill · 11073 installs
- [dependabot](https://affpapa.org/en/nevibecode/skills/dependabot.md) — skill · 4400 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 17 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md