malware-analysis-warning — Claude Code skill: analysis and setup
This skill flags repositories that may distribute malware while posing as antivirus or other security software.
npx skills add reason-machines/security-skills --skill malware-analysis-warning -a claude-codeWhat malware-analysis-warning does
The skill guides an agent through checks for crack and keygen wording, pre-activated software claims, brand impersonation, inflated popularity, and missing source code. It also instructs the agent to avoid downloading or running files from suspicious repositories.
Its examples include Go code for scoring repository names, descriptions, and README presence, plus a GitHub scanner. The scanner considers repository metadata, commit history, file types, and malware-related patterns. Automated scanning reads its GitHub token from GITHUB_TOKEN, so that environment variable must be configured before using the scanner.
What it helps with
- inspect a repository offering cracked security software
- spot antivirus brand impersonation
- score a repository with no source code
- check GitHub metadata for malware indicators
Example prompts for the agent
- Inspect this antivirus repository for signs of malicious distribution.
- Assess whether this keygen project is safe and explain the warning signs.
- Scan this GitHub repository and prepare a threat report.
How to install malware-analysis-warning
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-analysis-warning -a claude-code2Manually: put the files in place
~/.claude/skills/malware-analysis-warning/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/malware-analysis-warning/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-analysis-warning -a codex2Manually: put the files in place
.agents/skills/malware-analysis-warning/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-analysis-warning -a cursor2Manually: put the files in place
.cursor/skills/malware-analysis-warning/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install reason-machines/security-skills malware-analysis-warning2Manually: put the files in place
.github/skills/malware-analysis-warning/SKILL.md1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-analysis-warning -a gemini-cli2Platform CLI
gemini skills install https://github.com/reason-machines/security-skills --path skills/malware-analysis-warningManually: put the files in place
.devin/skills/malware-analysis-warning/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-analysis-warning -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about malware-analysis-warning
How do I install malware-analysis-warning in Claude Code?
Run npx skills add reason-machines/security-skills --skill malware-analysis-warning -a claude-code, then check ~/.claude/skills/malware-analysis-warning/SKILL.md.
What does malware-analysis-warning do?
It helps identify repositories that disguise malware distribution as legitimate security software. The skill provides risk indicators and guidance to avoid executing suspicious files.
What does the automated scanner require?
The scanner reads its GitHub access token from GITHUB_TOKEN. The examples also define VIRUSTOTAL_API_KEY and MALWARE_DB_URL for automated checking tools.
