# bitdefender-total-security-malware-analysis

Teaches coding agents to spot fraudulent repositories peddling fake software cracks and study typical malware distribution tactics.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 969 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/bitdefender-total-security-malware-analysis/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/bitdefender-total-security-malware-analysis

## What it does

This skill focuses on deceptive projects that impersonate commercial software like Bitdefender. Fraudulent repositories lure users with promises of pre-activated binaries, yet publish links to stealers and backdoors. The repository itself stays empty or contains minimal filler files.

Detection heuristics inside use Go snippets to assess public projects. The logic flags star growth exceeding 2.0 per day and scans descriptions for keywords like `keygen` or `bypass`. For local binaries, it outlines SHA-256 hashing alongside process monitoring.

Querying external signature databases through VirusTotal requires setting the `VIRUSTOTAL_API_KEY` environment variable. Without that token, automated hash lookups will fail.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill bitdefender-total-security-malware-analysis -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/bitdefender-total-security-malware-analysis/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/bitdefender-total-security-malware-analysis/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill bitdefender-total-security-malware-analysis -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/bitdefender-total-security-malware-analysis/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill bitdefender-total-security-malware-analysis -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/bitdefender-total-security-malware-analysis/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills bitdefender-total-security-malware-analysis
```

2. **Manually: put the files in place**
- File: `.github/skills/bitdefender-total-security-malware-analysis/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill bitdefender-total-security-malware-analysis -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/bitdefender-total-security-malware-analysis
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/bitdefender-total-security-malware-analysis/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill bitdefender-total-security-malware-analysis -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/bitdefender-total-security-malware-analysis/SKILL.md

## When to use it
- spot fake GitHub repositories advertising cracked security software
- compute SHA-256 checksums to verify suspicious binary files
- identify behavioral red flags in processes modifying system registries

## Example prompts
- Inspect this cracked software repository for signs of malware distribution
- Calculate the SHA-256 hash for this executable and explain how to query VirusTotal
- Summarize common behavioral indicators of credential stealer payloads

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md