malware-distribution-awareness — Claude Code skill setup & use
Flags malicious repositories pretending to offer cracked security software and provides incident response commands for compromised Windows environments.
npx skills add reason-machines/security-skills --skill malware-distribution-awareness -a claude-codeWhat malware-distribution-awareness does
This skill guides assistants to spot fraudulent repositories posing as legitimate antivirus downloads. It focuses on typical scam indicators: piracy keywords, missing documentation, botted star counts with zero forks, and deceptive topics such as defender-bypass.
The instruction set includes a Go logic snippet to score repository risk alongside defensive PowerShell routines. When suspicious downloads occur, the built-in commands disconnect network adapters and review running processes for unauthorized activity.
All included containment and triage scripts rely exclusively on Windows PowerShell. Running them on Linux or macOS workstations will fail outright.
What it helps with
- detect trojans hiding inside fake antivirus distribution repositories
- shut down network adapters to contain an infected Windows machine
- audit scheduled tasks and startup items for malware persistence
- prepare abuse reports for deceptive GitHub projects
Example prompts for the agent
- Inspect this security repository for signs of fake downloads or malware topics.
- Give me PowerShell commands to isolate my workstation after running an untrusted binary.
- How do I report a fraudulent repository abusing antivirus brand names to GitHub?
How to install malware-distribution-awareness
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-distribution-awareness -a claude-code2Manually: put the files in place
~/.claude/skills/malware-distribution-awareness/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/malware-distribution-awareness/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-distribution-awareness -a codex2Manually: put the files in place
.agents/skills/malware-distribution-awareness/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-distribution-awareness -a cursor2Manually: put the files in place
.cursor/skills/malware-distribution-awareness/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install reason-machines/security-skills malware-distribution-awareness2Manually: put the files in place
.github/skills/malware-distribution-awareness/SKILL.md1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-distribution-awareness -a gemini-cli2Platform CLI
gemini skills install https://github.com/reason-machines/security-skills --path skills/malware-distribution-awarenessManually: put the files in place
.devin/skills/malware-distribution-awareness/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill malware-distribution-awareness -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about malware-distribution-awareness
How to install malware-distribution-awareness in Claude Code?
Run npx skills add reason-machines/security-skills --skill malware-distribution-awareness -a claude-code in your terminal. This writes the configuration file to ~/.claude/skills/malware-distribution-awareness/SKILL.md.
What does malware-distribution-awareness do?
It equips the assistant to spot fake software projects distributing malware and provides remediation commands if an untrusted binary was executed.
Which operating systems do the triage scripts support?
The containment and inspection steps use Windows PowerShell commands and Windows Defender utilities, meaning they apply only to Windows environments.
