# malware-analysis-warning

This skill flags repositories that may distribute malware while posing as antivirus or other security software.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 833 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/malware-analysis-warning/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/malware-analysis-warning

## What it does

The skill guides an agent through checks for crack and keygen wording, pre-activated software claims, brand impersonation, inflated popularity, and missing source code. It also instructs the agent to avoid downloading or running files from suspicious repositories.

Its examples include Go code for scoring repository names, descriptions, and README presence, plus a GitHub scanner. The scanner considers repository metadata, commit history, file types, and malware-related patterns. Automated scanning reads its GitHub token from `GITHUB_TOKEN`, so that environment variable must be configured before using the scanner.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-analysis-warning -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/malware-analysis-warning/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/malware-analysis-warning/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-analysis-warning -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/malware-analysis-warning/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-analysis-warning -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/malware-analysis-warning/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills malware-analysis-warning
```

2. **Manually: put the files in place**
- File: `.github/skills/malware-analysis-warning/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-analysis-warning -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/malware-analysis-warning
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/malware-analysis-warning/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-analysis-warning -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/malware-analysis-warning/SKILL.md

## When to use it
- inspect a repository offering cracked security software
- spot antivirus brand impersonation
- score a repository with no source code
- check GitHub metadata for malware indicators

## Example prompts
- Inspect this antivirus repository for signs of malicious distribution.
- Assess whether this keygen project is safe and explain the warning signs.
- Scan this GitHub repository and prepare a threat report.

## Similar
- [ctf-malware](https://affpapa.org/en/nevibecode/skills/ctf-malware.md) — skill · 8700 installs
- [analyzing-android-malware-with-apktool](https://affpapa.org/en/nevibecode/skills/analyzing-android-malware-with-apktool.md) — skill · 675 installs
- [reverse-engineering-android-malware-with-jadx](https://affpapa.org/en/nevibecode/skills/reverse-engineering-android-malware-with-jadx.md) — skill · 486 installs
- [stride-analysis-patterns](https://affpapa.org/en/nevibecode/skills/stride-analysis-patterns.md) — skill · 20506 installs
- [binary-analysis-patterns](https://affpapa.org/en/nevibecode/skills/binary-analysis-patterns.md) — skill · 10900 installs
- [variant-analysis](https://affpapa.org/en/nevibecode/skills/variant-analysis.md) — skill · 6400 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 42 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md