# bitdefender-malware-analysis

Teaches coding agents to spot fraudulent repositories peddling malicious installers and safely inspect suspicious payloads in network-free environments.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 784 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/bitdefender-malware-analysis/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/bitdefender-malware-analysis

## What it does

This skill guides coding agents through investigating fake software distribution channels on GitHub. Using a fraudulent Bitdefender crack repository as a reference, it flags specific deception patterns. These include automated star boosting exceeding two stars per day, topics like `defender-bypass`, missing documentation, and binary releases lacking visible source code.

The workflow outlines safe static triage inside isolated environments. It supplies Go patterns to score suspicious repositories and recommends inspecting files inside an unnetworked Docker container. The inspection relies on calculating SHA-256 hashes rather than running untrusted executables directly on the development machine.

Querying threat databases requires setting the `VIRUSTOTAL_API_KEY` environment variable. Never test suspicious binaries on the host system. Once indicators are collected, the agent structures a formal incident report to submit to GitHub Security.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill bitdefender-malware-analysis -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/bitdefender-malware-analysis/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/bitdefender-malware-analysis/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill bitdefender-malware-analysis -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/bitdefender-malware-analysis/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill bitdefender-malware-analysis -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/bitdefender-malware-analysis/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills bitdefender-malware-analysis
```

2. **Manually: put the files in place**
- File: `.github/skills/bitdefender-malware-analysis/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill bitdefender-malware-analysis -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/bitdefender-malware-analysis
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/bitdefender-malware-analysis/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill bitdefender-malware-analysis -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/bitdefender-malware-analysis/SKILL.md

## When to use it
- Detect fake open-source repositories distributing infostealers and droppers
- Set up an isolated network-free Docker container for static analysis
- Calculate SHA-256 file hashes and query threat databases safely
- Assemble incident evidence into an abuse report for GitHub Security

## Example prompts
- Evaluate this repository metadata for signs of star inflation and malware distribution
- Show the Docker command to safely inspect suspicious binaries without network access
- Generate a structured security report with file hashes and threat indicators

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md