# security-awareness-malicious-repository-detection

Flags malicious GitHub repositories pretending to be cracked or pirated software. Helps inspect suspicious code sources before downloading.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1100 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/security-awareness-malicious-repository-detection/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/security-awareness-malicious-repository-detection

## What it does

The skill evaluates GitHub descriptions and repository topics against malware red flags. It looks for piracy terms like keygens or loaders tied to security products. Topic tags mentioning defender bypasses also raise suspicion.

A scoring formula adds risk points for each match. Scoring fifty points or higher flags the project as dangerous. The scanner queries the GitHub repository endpoint directly.

Without a `GITHUB_TOKEN` environment variable, automated scans quickly hit GitHub rate limits.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-awareness-malicious-repository-detection -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/security-awareness-malicious-repository-detection/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/security-awareness-malicious-repository-detection/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-awareness-malicious-repository-detection -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/security-awareness-malicious-repository-detection/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-awareness-malicious-repository-detection -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/security-awareness-malicious-repository-detection/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills security-awareness-malicious-repository-detection
```

2. **Manually: put the files in place**
- File: `.github/skills/security-awareness-malicious-repository-detection/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-awareness-malicious-repository-detection -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/security-awareness-malicious-repository-detection
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/security-awareness-malicious-repository-detection/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-awareness-malicious-repository-detection -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/security-awareness-malicious-repository-detection/SKILL.md

## When to use it
- spot fake software cracks and keygen loaders on GitHub
- detect manipulated star counts and exploit-related topics
- calculate a risk score from repository metadata
- screen suspicious repositories before cloning them locally

## Example prompts
- Analyze this GitHub project description for crack and malware indicators
- Check if this repository matches fake software crack patterns
- Inspect the metadata of this repository to evaluate its risk score

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md