Skip to main content
affpapa.org
RU EN
skill CX Codex

report-malicious-repository — Claude Code skill: spot fake repos

Flags repositories that pose as antivirus or other commercial software and walks you through filing a GitHub report.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add reason-machines/security-skills --skill report-malicious-repository -a claude-code
Open on GitHub

What report-malicious-repository does

The skill reads repository metadata against a list of red flags: piracy words like keygen, crack, loader or serial in the description, antivirus brand names used without authorization, a missing README, no source code, a fresh account with inflated stars. It counts the hits and assigns a risk level from LOW to CRITICAL.

Inside are Go functions that analyze the description and topics, check for brand impersonation and weigh repository age, plus a script that calls the GitHub API and prints every flag it finds. That script needs GITHUB_TOKEN in your environment; without it the call fails. GitHub has no public API for abuse reports, so the script only prints the report URL and the text to paste — you submit it through the web form.

A ready report template covers the repository name, the violation type, a description and the evidence. The checks are heuristics, so a legitimate project with the word premium in its description will also trip them. Open the repo and read the code before you report anything.

What it helps with

  • tell a fake antivirus repo from a real project
  • check a repo with keygen in its description for malware signs
  • gather evidence for a GitHub abuse report
  • score repository metadata by risk level
  • filter suspicious dependencies during a scan

Example prompts for the agent

  • check DragonflyTomb/Avast-Premium-Security-2026 for malware red flags
  • draft a GitHub report for this repository
  • what red flags does this project with keygen in the description have?

How to install report-malicious-repository

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill report-malicious-repository -a claude-code

2Manually: put the files in place

~/.claude/skills/report-malicious-repository/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/report-malicious-repository/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about report-malicious-repository

How do I install report-malicious-repository in Claude?

Run npx skills add reason-machines/security-skills --skill report-malicious-repository -a claude-code. The skill lands at ~/.claude/skills/report-malicious-repository/SKILL.md.

What does report-malicious-repository do?

It looks for signs of a malicious repository — piracy keywords, brand impersonation, missing source code — and assigns a risk level. Then it helps you file a report through GitHub's form.

What does the skill need to run?

Scanning through the GitHub API requires a GITHUB_TOKEN environment variable. The report itself still goes through the web form, since GitHub has no public API for abuse reports.

Similar skills

Everything for Security →
porting-another-repository dyoshikawa Reads a feature in your current repo and the target repo's conventions, then writes a porting plan into tmp/ as files you apply yourself. CX Codex +1 ★ 1,552repo stars draft-issue-to-external-repository dyoshikawa Drafts a GitHub issue for a repository you do not own: reads the project's templates and title style, settles scope with you, and saves the body to a file. CX Codex +1 ★ 1,552repo stars make-repo-contribution official github This skill checks repository rules before issues, branches, commits, or pull requests, then guides the contribution workflow. 11,073installs dependabot official github A GitHub Copilot skill that helps write and tune .github/dependabot.yml: grouped updates, monorepo patterns, security updates. 4,400installs secrets-in-git-history UseOSINT A skill that teaches the agent to hunt API keys, tokens and identities in git history and on GitHub, not just in the checked-out tree. CX Codex +1 1,900installs github-code-review ruvnet Runs a swarm of specialized AI agents to inspect GitHub pull requests for security, performance, and architecture issues. CX Codex +1 1,300installs

From the same set17

avast-premium-security-malware-analysis A skill for studying Avast Premium Security internals: behavior shield, real-time protection, malware detection. Built for educational and defensive research. CX Codex +1 1,100installs avast-security-awareness Trains your agent to flag repositories posing as antivirus tools or cracked software, and to warn you before anything gets downloaded. CX Codex +1 1,100installs avast-premium-security-analysis A skill for studying Avast Premium Security components and antivirus protection mechanisms. Useful when you take apart defensive software inside an isolated environment. CX Codex +1 1,100installs malware-warning-avast-keygen This skill spots repositories posing as an Avast Premium Security crack or keygen and explains why nothing from them should be run. CX Codex +1 1,100installs security-threat-awareness Flags repositories that disguise malicious downloads as legitimate security tools. Use it before installing software from GitHub. CX Codex +1 1,000installs malware-analysis-dragonflyTomb-avast A skill for pulling apart repositories that pose as antivirus installers. It helps you tell a fake distribution from the real thing. CX Codex +1 1,000installs avast-premium-security-awareness A skill that flags repositories posing as antivirus software while actually pushing malware. CX Codex +1 1,000installs malware-warning-bitdefender-crack Flags repositories that disguise malware as cracked Bitdefender software and helps explain the signals behind the threat. CX Codex +1 971installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor