# malware-distribution-awareness

Flags malicious repositories pretending to offer cracked security software and provides incident response commands for compromised Windows environments.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 815 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/malware-distribution-awareness/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/malware-distribution-awareness

## What it does

This skill guides assistants to spot fraudulent repositories posing as legitimate antivirus downloads. It focuses on typical scam indicators: piracy keywords, missing documentation, botted star counts with zero forks, and deceptive topics such as `defender-bypass`.

The instruction set includes a Go logic snippet to score repository risk alongside defensive PowerShell routines. When suspicious downloads occur, the built-in commands disconnect network adapters and review running processes for unauthorized activity.

All included containment and triage scripts rely exclusively on Windows PowerShell. Running them on Linux or macOS workstations will fail outright.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-distribution-awareness -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/malware-distribution-awareness/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/malware-distribution-awareness/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-distribution-awareness -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/malware-distribution-awareness/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-distribution-awareness -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/malware-distribution-awareness/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills malware-distribution-awareness
```

2. **Manually: put the files in place**
- File: `.github/skills/malware-distribution-awareness/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-distribution-awareness -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/malware-distribution-awareness
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/malware-distribution-awareness/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-distribution-awareness -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/malware-distribution-awareness/SKILL.md

## When to use it
- detect trojans hiding inside fake antivirus distribution repositories
- shut down network adapters to contain an infected Windows machine
- audit scheduled tasks and startup items for malware persistence
- prepare abuse reports for deceptive GitHub projects

## Example prompts
- Inspect this security repository for signs of fake downloads or malware topics.
- Give me PowerShell commands to isolate my workstation after running an untrusted binary.
- How do I report a fraudulent repository abusing antivirus brand names to GitHub?

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md