# malware-detection-awareness

Helps spot malicious repositories, trojanized software packages, and pirated installers. Useful when vetting untrusted code sources.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1100 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/malware-detection-awareness/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/malware-detection-awareness

## What it does

This skill teaches coding agents to spot unsafe software distribution patterns. It protects against malicious packages.

The rules highlight warning signs like artificial star counts on empty repositories or claims of pre-activated commercial software. Sample Go snippets demonstrate how to parse repository descriptions for forbidden terms like `keygen`.

Other sections cover Authenticode signature verification and Linux containment steps. Remote URL scanning depends on `VIRUSTOTAL_API_KEY`. Without that variable, network lookups will fail.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-detection-awareness -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/malware-detection-awareness/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/malware-detection-awareness/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-detection-awareness -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/malware-detection-awareness/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-detection-awareness -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/malware-detection-awareness/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills malware-detection-awareness
```

2. **Manually: put the files in place**
- File: `.github/skills/malware-detection-awareness/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-detection-awareness -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/malware-detection-awareness
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/malware-detection-awareness/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-detection-awareness -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/malware-detection-awareness/SKILL.md

## When to use it
- spot fake or compromised open-source repositories
- audit software packages for trademark abuse and activation cracks
- verify digital signatures on Windows installers
- run emergency containment commands on an infected host

## Example prompts
- What signs indicate that this software repository might be distributing malware?
- Show me how to verify the Authenticode signature of an installer executable.
- Which Linux commands should I run first if a suspicious binary was executed?

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md