# malware-detection-security-awareness

Helps AI agents spot malicious repositories disguised as cracked security software. Useful when verifying GitHub projects and avoiding malware delivery vectors.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 910 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/malware-detection-security-awareness/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/malware-detection-security-awareness

## What it does

The skill teaches an agent to spot malicious GitHub projects pretending to be security utilities or activation loaders. It scans for indicators such as piracy keywords in titles, missing documentation, and unverified licenses. A high star creation rate combined with zero forks is treated as a major red flag.

Included guidelines cover verification workflows, such as checking SHA-256 hashes against vendor values and running scans via ClamAV or Windows Defender. It also contains incident steps, including disabling network interfaces with `netsh` if suspicious code was launched.

This skill checks repository metadata and social engineering patterns. It does not perform static decompilation or binary sandbox analysis.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-detection-security-awareness -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/malware-detection-security-awareness/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/malware-detection-security-awareness/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-detection-security-awareness -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/malware-detection-security-awareness/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-detection-security-awareness -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/malware-detection-security-awareness/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills malware-detection-security-awareness
```

2. **Manually: put the files in place**
- File: `.github/skills/malware-detection-security-awareness/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-detection-security-awareness -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/malware-detection-security-awareness
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/malware-detection-security-awareness/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-detection-security-awareness -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/malware-detection-security-awareness/SKILL.md

## When to use it
- spot fake security software repos carrying trojans
- identify inflated GitHub stars with zero forks
- verify binary SHA-256 checksums before execution
- isolate the workstation after running suspicious files

## Example prompts
- Check this GitHub repository for signs of a cracked software scam.
- How do I identify fake security tools on GitHub?
- Show me an example in Go to verify an installer hash against the vendor SHA-256.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md