# report-malicious-repository

Flags repositories that pose as antivirus or other commercial software and walks you through filing a GitHub report.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1100 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/report-malicious-repository/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/report-malicious-repository

## What it does

The skill reads repository metadata against a list of red flags: piracy words like keygen, crack, loader or serial in the description, antivirus brand names used without authorization, a missing README, no source code, a fresh account with inflated stars. It counts the hits and assigns a risk level from LOW to CRITICAL.

Inside are Go functions that analyze the description and topics, check for brand impersonation and weigh repository age, plus a script that calls the GitHub API and prints every flag it finds. That script needs `GITHUB_TOKEN` in your environment; without it the call fails. GitHub has no public API for abuse reports, so the script only prints the report URL and the text to paste — you submit it through the web form.

A ready report template covers the repository name, the violation type, a description and the evidence. The checks are heuristics, so a legitimate project with the word premium in its description will also trip them. Open the repo and read the code before you report anything.

## Requirements
- Works with: GitHub

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill report-malicious-repository -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/report-malicious-repository/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/report-malicious-repository/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill report-malicious-repository -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/report-malicious-repository/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill report-malicious-repository -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/report-malicious-repository/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills report-malicious-repository
```

2. **Manually: put the files in place**
- File: `.github/skills/report-malicious-repository/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill report-malicious-repository -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/report-malicious-repository
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/report-malicious-repository/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill report-malicious-repository -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/report-malicious-repository/SKILL.md

## When to use it
- tell a fake antivirus repo from a real project
- check a repo with keygen in its description for malware signs
- gather evidence for a GitHub abuse report
- score repository metadata by risk level
- filter suspicious dependencies during a scan

## Example prompts
- check DragonflyTomb/Avast-Premium-Security-2026 for malware red flags
- draft a GitHub report for this repository
- what red flags does this project with keygen in the description have?

## Similar
- [porting-another-repository](https://affpapa.org/en/nevibecode/skills/porting-another-repository.md) — skill · ★ 1552
- [draft-issue-to-external-repository](https://affpapa.org/en/nevibecode/skills/draft-issue-to-external-repository.md) — skill · ★ 1552
- [make-repo-contribution](https://affpapa.org/en/nevibecode/skills/make-repo-contribution.md) — skill · 11073 installs
- [dependabot](https://affpapa.org/en/nevibecode/skills/dependabot.md) — skill · 4400 installs
- [secrets-in-git-history](https://affpapa.org/en/nevibecode/skills/secrets-in-git-history.md) — skill · 1900 installs
- [github-code-review](https://affpapa.org/en/nevibecode/skills/github-code-review.md) — skill · 1300 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 17 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md