# identify-malicious-repository

Flags deceptive GitHub projects distributing malware disguised as security software. It detects fake star metrics, keygen lures, and trojan drops before you download code.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 974 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/identify-malicious-repository/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/identify-malicious-repository

## What it does

This skill inspects public GitHub repositories for scam indicators. It flags projects claiming to supply pre-activated packages, serial key generators, or cracked utilities under recognized vendor names such as Norton, Avast, or Adobe.

The logic relies on Python and shell scripts querying the GitHub API. It highlights star-to-fork discrepancies, missing documentation files, and suspicious naming patterns to assign an overall threat level. To avoid hitting public GitHub API rate limits during repeated scans, set a personal `GITHUB_TOKEN` in your environment.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill identify-malicious-repository -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/identify-malicious-repository/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/identify-malicious-repository/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill identify-malicious-repository -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/identify-malicious-repository/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill identify-malicious-repository -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/identify-malicious-repository/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills identify-malicious-repository
```

2. **Manually: put the files in place**
- File: `.github/skills/identify-malicious-repository/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill identify-malicious-repository -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/identify-malicious-repository
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/identify-malicious-repository/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill identify-malicious-repository -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/identify-malicious-repository/SKILL.md

## When to use it
- detect fake security tools delivering hidden malware
- identify artificial star growth with zero forks
- scan GitHub API responses for software cracking terms
- calculate a risk score for suspicious software distributions

## Example prompts
- Scan `viceofficialtower74/Avast-Premium-Security-Windows-Latest` for malware indicators and fake engagement.
- Check this repository URL via the GitHub API to see if it is distributing a trojan or keygen.
- Inspect the repository description and star counts for brand impersonation red flags.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md