malware-detection-and-reporting — Claude Code skill
This skill flags repositories that disguise malware as legitimate security software and helps assemble evidence for a report.
npx skills add reason-machines/security-skills --skill malware-detection-and-reporting -a claude-codeWhat malware-detection-and-reporting does
The skill examines repository signals such as cracked or keygen offers for commercial software, risky topics like defender-bypass and rootkit, missing implementation files, unusual engagement, and .exe, .dll, or .scr files without source. It also checks for the NOASSERTION license marker and known antivirus names.
Its examples include a Go analyzer that gathers suspicious keywords and topics, then computes a risk score. Other code calls the GitHub API and builds an evidence report containing the repository description, topics, star count, creation date, and selected indicators.
The curl example sends authentication through GITHUB_TOKEN; that variable is needed for the token-based request. Reporting guidance covers GitHub’s web flow, including abuse or content reports and the malware distribution or phishing categories.
What it helps with
- flag a repository that may distribute malware
- inspect descriptions and topics for risky indicators
- collect repository evidence through the GitHub API
- draft facts for a GitHub abuse report
- separate cracked-software projects from real source repositories
Example prompts for the agent
- Check this repository for signs of malware distribution and list the evidence.
- Inspect the project description and topics, then calculate its risk score.
- Collect repository details through the GitHub API and prepare a report for GitHub.
How to install malware-detection-and-reporting
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-detection-and-reporting -a claude-code2Manually: put the files in place
~/.claude/skills/malware-detection-and-reporting/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/malware-detection-and-reporting/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-detection-and-reporting -a codex2Manually: put the files in place
.agents/skills/malware-detection-and-reporting/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-detection-and-reporting -a cursor2Manually: put the files in place
.cursor/skills/malware-detection-and-reporting/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install reason-machines/security-skills malware-detection-and-reporting2Manually: put the files in place
.github/skills/malware-detection-and-reporting/SKILL.md1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-detection-and-reporting -a gemini-cli2Platform CLI
gemini skills install https://github.com/reason-machines/security-skills --path skills/malware-detection-and-reportingManually: put the files in place
.devin/skills/malware-detection-and-reporting/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-detection-and-reporting -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about malware-detection-and-reporting
How do I install malware-detection-and-reporting in Claude Code?
Run npx skills add reason-machines/security-skills --skill malware-detection-and-reporting -a claude-code, then check ~/.claude/skills/malware-detection-and-reporting/SKILL.md.
What does malware-detection-and-reporting do?
It reviews repositories that present cracks, keygens, or similar malware delivery as security software, then helps collect evidence for reporting.
Is GITHUB_TOKEN required?
The curl example passes authentication through GITHUB_TOKEN. The Go example adds a token when that environment variable is set.
