bitdefender-malware-analysis — Claude Code skill: overview
Teaches coding agents to spot fraudulent repositories peddling malicious installers and safely inspect suspicious payloads in network-free environments.
npx skills add reason-machines/security-skills --skill bitdefender-malware-analysis -a claude-codeWhat bitdefender-malware-analysis does
This skill guides coding agents through investigating fake software distribution channels on GitHub. Using a fraudulent Bitdefender crack repository as a reference, it flags specific deception patterns. These include automated star boosting exceeding two stars per day, topics like defender-bypass, missing documentation, and binary releases lacking visible source code.
The workflow outlines safe static triage inside isolated environments. It supplies Go patterns to score suspicious repositories and recommends inspecting files inside an unnetworked Docker container. The inspection relies on calculating SHA-256 hashes rather than running untrusted executables directly on the development machine.
Querying threat databases requires setting the VIRUSTOTAL_API_KEY environment variable. Never test suspicious binaries on the host system. Once indicators are collected, the agent structures a formal incident report to submit to GitHub Security.
What it helps with
- Detect fake open-source repositories distributing infostealers and droppers
- Set up an isolated network-free Docker container for static analysis
- Calculate SHA-256 file hashes and query threat databases safely
- Assemble incident evidence into an abuse report for GitHub Security
Example prompts for the agent
- Evaluate this repository metadata for signs of star inflation and malware distribution
- Show the Docker command to safely inspect suspicious binaries without network access
- Generate a structured security report with file hashes and threat indicators
How to install bitdefender-malware-analysis
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill bitdefender-malware-analysis -a claude-code2Manually: put the files in place
~/.claude/skills/bitdefender-malware-analysis/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/bitdefender-malware-analysis/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill bitdefender-malware-analysis -a codex2Manually: put the files in place
.agents/skills/bitdefender-malware-analysis/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill bitdefender-malware-analysis -a cursor2Manually: put the files in place
.cursor/skills/bitdefender-malware-analysis/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install reason-machines/security-skills bitdefender-malware-analysis2Manually: put the files in place
.github/skills/bitdefender-malware-analysis/SKILL.md1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill bitdefender-malware-analysis -a gemini-cli2Platform CLI
gemini skills install https://github.com/reason-machines/security-skills --path skills/bitdefender-malware-analysisManually: put the files in place
.devin/skills/bitdefender-malware-analysis/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill bitdefender-malware-analysis -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about bitdefender-malware-analysis
How to install bitdefender-malware-analysis in Claude Code?
Run npx skills add reason-machines/security-skills --skill bitdefender-malware-analysis -a claude-code. The tool configures the skill directly for the agent.
What does bitdefender-malware-analysis do?
It provides inspection routines to identify fake GitHub projects distributing malware and outlines rules for non-destructive static analysis.
What credentials are required to use VirusTotal?
You need to set the VIRUSTOTAL_API_KEY environment variable. The skill only queries calculated SHA-256 checksums without uploading the raw file sample.
