# malware-detection-and-removal

A skill for spotting repositories that pose as cracked software and deciding what to do about them.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 952 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/malware-detection-and-removal/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/malware-detection-and-removal

## What it does

The skill walks through the tells of a repo pretending to be legitimate software: descriptions stuffed with crack, keygen, loader or pre-activated, version numbers set in future years, topics that lean on bypass and exploit wording. It splits the work into steps. First you look at repository metadata, then at the files themselves. For scoring there is a Go example: a struct holding name, description, topics and star rate, plus a function that adds points for piracy keywords, dangerous topics such as defender-bypass and thread-hijacking, and a missing README. Above 50 points reads as high risk, above 30 as suspicious.

The second step checks content. The skill walks the directory tree, looks for source files by extension, and flags .exe, .dll and .bat separately. No source code plus executables is a reason to leave the project alone. The same section says plainly not to clone or run anything from a suspicious repo — no `git clone`, no `go run`, no `./setup.exe`.

Reporting comes next. There is the Security tab route on GitHub and the support form; the API variant expects `GITHUB_TOKEN` in your environment. The source text is cut off, so the removal side of the workflow is not spelled out — treat this as triage and reporting.

## Requirements
- Works with: GitHub

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-detection-and-removal -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/malware-detection-and-removal/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/malware-detection-and-removal/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-detection-and-removal -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/malware-detection-and-removal/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-detection-and-removal -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/malware-detection-and-removal/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills malware-detection-and-removal
```

2. **Manually: put the files in place**
- File: `.github/skills/malware-detection-and-removal/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-detection-and-removal -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/malware-detection-and-removal
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/malware-detection-and-removal/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-detection-and-removal -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/malware-detection-and-removal/SKILL.md

## When to use it
- tell a cracked-software repo from a real project
- score risk from description, topics and stars
- find suspicious .exe and .dll files in a project tree
- file a report against a repo distributing malware
- check where to get a legitimate antivirus build

## Example prompts
- check this repository for malware distribution patterns
- analyze the project description and topics for piracy keywords
- draft a report for a suspicious repository

## Similar
- [analyzing-linux-elf-malware](https://affpapa.org/en/nevibecode/skills/analyzing-linux-elf-malware.md) — skill · 457 installs
- [make-repo-contribution](https://affpapa.org/en/nevibecode/skills/make-repo-contribution.md) — skill · 11073 installs
- [dependabot](https://affpapa.org/en/nevibecode/skills/dependabot.md) — skill · 4400 installs
- [secrets-in-git-history](https://affpapa.org/en/nevibecode/skills/secrets-in-git-history.md) — skill · 1900 installs
- [github-code-review](https://affpapa.org/en/nevibecode/skills/github-code-review.md) — skill · 1300 installs
- [github-sensitive-data-cleanup](https://affpapa.org/en/nevibecode/skills/github-sensitive-data-cleanup.md) — skill · 353 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 17 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md