skill CX Codex

malware-analysis-dragonflyTomb-avast — Claude Code skill: spot fake

Q: How do I install malware-analysis-dragonflyTomb-avast in Claude?

Run `npx skills add reason-machines/security-skills --skill malware-analysis-dragonflyTomb-avast -a claude-code`. The skill file then lands at `~/.claude/skills/malware-analysis-dragonflyTomb-avast/SKILL.md`.

A skill for pulling apart repositories that pose as antivirus installers. It helps you tell a fake distribution from the real thing.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓

npx skills add reason-machines/security-skills --skill malware-analysis-dragonflytomb-avast -a claude-code
npx skills add reason-machines/security-skills --skill malware-analysis-dragonflyTomb-avast -a claude-code

Open on GitHub

What malware-analysis-dragonflyTomb-avast does

The skill walks through the DragonflyTomb/Avast-Premium-Security-2026 repository and lays out why it is not an official Avast Premium Security build. You get a checklist of red flags: words like "Keygen", "Pre-Activated", "Loader" and "Serial" in the name, a missing README, a NOASSERTION license on commercial software, and a "retdec" topic sitting next to an antivirus. Star inflation and the "2026" version label get their own section.

From there it moves into static analysis. On source code the skill suggests grepping for suspicious imports (syscall, unsafe, os/exec, net/http, crypto/aes), obfuscation markers (base64, XOR, decode) and persistence hooks such as the registry, Startup folder or Task Scheduler. A Go example hashes each file with SHA-256 and flags the suspicious ones in a directory tree.

Isolation is the part people skip. The skill recommends a container with networking off (docker run -it --rm --network none golang:1.21) and cloning the repository there without running it. Submitting a sample to VirusTotal needs the VIRUSTOTAL_API_KEY environment variable set, otherwise the example code returns an error. Open a repo like this on your daily machine and hit build, and you have thrown away the isolation the whole exercise depends on.

What it helps with

tell a fake antivirus installer from an official distribution
find obfuscation markers in Go source
check imports for os/exec and net/http before building
hash a file with SHA-256 and record it for a report
set up an isolated environment to examine a malicious repo

Example prompts for the agent

analyze this suspicious avast installer repository
check if this security software repository is legitimate
identify keygen and loader malware indicators in this Go code

How to install malware-analysis-dragonflyTomb-avast

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill malware-analysis-dragonflytomb-avast -a claude-code

npx skills add reason-machines/security-skills --skill malware-analysis-dragonflyTomb-avast -a claude-code

2Manually: put the files in place

~/.claude/skills/malware-analysis-dragonflyTomb-avast/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/malware-analysis-dragonflyTomb-avast/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill malware-analysis-dragonflyTomb-avast -a codex

2Manually: put the files in place

.agents/skills/malware-analysis-dragonflyTomb-avast/SKILL.md

For all projects use ~/.agents/skills/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill malware-analysis-dragonflyTomb-avast -a cursor

2Manually: put the files in place

.cursor/skills/malware-analysis-dragonflyTomb-avast/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install reason-machines/security-skills malware-analysis-dragonflyTomb-avast

2Manually: put the files in place

.github/skills/malware-analysis-dragonflyTomb-avast/SKILL.md

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill malware-analysis-dragonflyTomb-avast -a gemini-cli

2Platform CLI

gemini skills install https://github.com/reason-machines/security-skills --path skills/malware-analysis-dragonflyTomb-avast

Manually: put the files in place

.devin/skills/malware-analysis-dragonflyTomb-avast/SKILL.md

The legacy .windsurf/skills/ path still works

Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill malware-analysis-dragonflyTomb-avast -a opencode

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about malware-analysis-dragonflyTomb-avast

How do I install malware-analysis-dragonflyTomb-avast in Claude?

Run npx skills add reason-machines/security-skills --skill malware-analysis-dragonflyTomb-avast -a claude-code. The skill file then lands at ~/.claude/skills/malware-analysis-dragonflyTomb-avast/SKILL.md.

What does this skill do?

It examines a repository disguised as an Avast Premium Security installer and points out the signs of malware distribution. It also covers static analysis of Go source, with code for spotting suspicious imports and obfuscation.

What do I need before using it?

Work inside an isolated container or VM with no network access. Submitting a sample to VirusTotal requires the VIRUSTOTAL_API_KEY environment variable.

Similar skills

Everything for Security →

analyzing-packed-malware-with-upx-unpacker mahipal This skill walks you through unpacking a disguised UPX sample and recovering the original executable for static analysis. CX Codex +1 303installs analyzing-linux-elf-malware mahipal A skill that walks an agent through dissecting suspicious Linux ELF binaries: headers, strings, syscalls, Ghidra. Useful when a server or container looks compromised. CX Codex +1 457installs deep-analysis cyberkaida A skill for depth-first binary investigation: answers questions like what a function does or whether crypto is involved. CX Codex +1 516installs ctf-rev cyberkaida Solves CTF reverse engineering challenges by systematically tracing input, identifying transformations, and isolating flag validation paths. CX Codex +1 321installs variant-analysis trailofbits Finds related occurrences of an already identified defect across a repository. Use it after a vulnerability or logic issue turns up and similar code needs checking. CX Codex +1 6,400installs constant-time-analysis trailofbits Inspects compiled assembly and bytecode for timing side-channels. It flags secret-dependent branches and variable-time operations in crypto routines. CX Codex +1 5,400installs

From the same set17

avast-security-awareness Trains your agent to flag repositories posing as antivirus tools or cracked software, and to warn you before anything gets downloaded. CX Codex +1 1,100installs avast-premium-security-analysis A skill for studying Avast Premium Security components and antivirus protection mechanisms. Useful when you take apart defensive software inside an isolated environment. CX Codex +1 1,100installs malware-warning-avast-keygen This skill spots repositories posing as an Avast Premium Security crack or keygen and explains why nothing from them should be run. CX Codex +1 1,100installs security-threat-awareness Flags repositories that disguise malicious downloads as legitimate security tools. Use it before installing software from GitHub. CX Codex +1 1,000installs avast-premium-security-awareness A skill that flags repositories posing as antivirus software while actually pushing malware. CX Codex +1 1,000installs malware-warning-bitdefender-crack Flags repositories that disguise malware as cracked Bitdefender software and helps explain the signals behind the threat. CX Codex +1 971installs malware-detection-and-removal A skill for spotting repositories that pose as cracked software and deciding what to do about them. CX Codex +1 952installs npm-security-best-practices Guides npm dependency hardening, supply-chain attack prevention, and safer package-manager settings. Useful when reviewing Node.js installs. CX Codex +1 919installs