malware-detection-and-removal — Claude Code skill: spot fake repos
A skill for spotting repositories that pose as cracked software and deciding what to do about them.
npx skills add reason-machines/security-skills --skill malware-detection-and-removal -a claude-codeWhat malware-detection-and-removal does
The skill walks through the tells of a repo pretending to be legitimate software: descriptions stuffed with crack, keygen, loader or pre-activated, version numbers set in future years, topics that lean on bypass and exploit wording. It splits the work into steps. First you look at repository metadata, then at the files themselves. For scoring there is a Go example: a struct holding name, description, topics and star rate, plus a function that adds points for piracy keywords, dangerous topics such as defender-bypass and thread-hijacking, and a missing README. Above 50 points reads as high risk, above 30 as suspicious.
The second step checks content. The skill walks the directory tree, looks for source files by extension, and flags .exe, .dll and .bat separately. No source code plus executables is a reason to leave the project alone. The same section says plainly not to clone or run anything from a suspicious repo — no git clone, no go run, no ./setup.exe.
Reporting comes next. There is the Security tab route on GitHub and the support form; the API variant expects GITHUB_TOKEN in your environment. The source text is cut off, so the removal side of the workflow is not spelled out — treat this as triage and reporting.
What it helps with
- tell a cracked-software repo from a real project
- score risk from description, topics and stars
- find suspicious .exe and .dll files in a project tree
- file a report against a repo distributing malware
- check where to get a legitimate antivirus build
Example prompts for the agent
- check this repository for malware distribution patterns
- analyze the project description and topics for piracy keywords
- draft a report for a suspicious repository
How to install malware-detection-and-removal
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-detection-and-removal -a claude-code2Manually: put the files in place
~/.claude/skills/malware-detection-and-removal/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/malware-detection-and-removal/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-detection-and-removal -a codex2Manually: put the files in place
.agents/skills/malware-detection-and-removal/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-detection-and-removal -a cursor2Manually: put the files in place
.cursor/skills/malware-detection-and-removal/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install reason-machines/security-skills malware-detection-and-removal2Manually: put the files in place
.github/skills/malware-detection-and-removal/SKILL.md1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-detection-and-removal -a gemini-cli2Platform CLI
gemini skills install https://github.com/reason-machines/security-skills --path skills/malware-detection-and-removalManually: put the files in place
.devin/skills/malware-detection-and-removal/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-detection-and-removal -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about malware-detection-and-removal
How do I install malware-detection-and-removal in Claude?
Run npx skills add reason-machines/security-skills --skill malware-detection-and-removal -a claude-code. The skill file then lands at ~/.claude/skills/malware-detection-and-removal/SKILL.md.
What does malware-detection-and-removal do?
It helps you identify and document repositories that masquerade as legitimate software while pushing malware. It covers metadata and content checks, with Go examples for scoring threat level.
What does the skill need to run?
Filing a report through the GitHub API needs GITHUB_TOKEN in your environment. The repository checks themselves run locally.
