Skip to main content
affpapa.org
RU EN
skill CX Codex

identify-malicious-repository — Claude Code skill: how to install

Flags deceptive GitHub projects distributing malware disguised as security software. It detects fake star metrics, keygen lures, and trojan drops before you download code.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add reason-machines/security-skills --skill identify-malicious-repository -a claude-code
Open on GitHub

What identify-malicious-repository does

This skill inspects public GitHub repositories for scam indicators. It flags projects claiming to supply pre-activated packages, serial key generators, or cracked utilities under recognized vendor names such as Norton, Avast, or Adobe.

The logic relies on Python and shell scripts querying the GitHub API. It highlights star-to-fork discrepancies, missing documentation files, and suspicious naming patterns to assign an overall threat level. To avoid hitting public GitHub API rate limits during repeated scans, set a personal GITHUB_TOKEN in your environment.

What it helps with

  • detect fake security tools delivering hidden malware
  • identify artificial star growth with zero forks
  • scan GitHub API responses for software cracking terms
  • calculate a risk score for suspicious software distributions

Example prompts for the agent

  • Scan viceofficialtower74/Avast-Premium-Security-Windows-Latest for malware indicators and fake engagement.
  • Check this repository URL via the GitHub API to see if it is distributing a trojan or keygen.
  • Inspect the repository description and star counts for brand impersonation red flags.

How to install identify-malicious-repository

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill identify-malicious-repository -a claude-code

2Manually: put the files in place

~/.claude/skills/identify-malicious-repository/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/identify-malicious-repository/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about identify-malicious-repository

How do I install identify-malicious-repository in Claude Code?

Run npx skills add reason-machines/security-skills --skill identify-malicious-repository -a claude-code in your terminal. This creates the skill configuration at ~/.claude/skills/identify-malicious-repository/SKILL.md.

What does the identify-malicious-repository skill do?

It evaluates suspicious GitHub repositories to check if they pose as legitimate applications. The inspection highlights piracy keywords, abnormal star counts, and brand hijacking.

What dependencies are needed to run the detection scripts?

Running the Python script requires Python with the requests package and a GITHUB_TOKEN environment variable. The bash alternative relies on standard curl and jq.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set69

avast-security-analysis This skill examines Avast components, runtime defenses, and behavioral detection. Use it when researching antivirus internals on Windows. CX Codex +1 1,000installs avast-premium-security-awareness A skill that flags repositories posing as antivirus software while actually pushing malware. CX Codex +1 1,000installs avast-premium-security-malware-detection This skill inspects suspicious repositories posing as antivirus installers and points out where malware distribution starts. CX Codex +1 989installs mcp-security-hub This skill spins up 38 Dockerized MCP servers for offensive security tooling and wires them into an AI assistant. CX Codex +1 987installs malware-warning-bitdefender-crack Flags repositories that disguise malware as cracked Bitdefender software and helps explain the signals behind the threat. CX Codex +1 971installs bitdefender-total-security-malware-analysis Teaches coding agents to spot fraudulent repositories peddling fake software cracks and study typical malware distribution tactics. CX Codex +1 969installs malware-detection-and-removal A skill for spotting repositories that pose as cracked software and deciding what to do about them. CX Codex +1 952installs bitdefender-total-security-awareness Instructs the AI to spot malware distribution repos disguised as antivirus cracks, stop dangerous execution, and recommend safe software. CX Codex +1 952installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor