security-threat-awareness — Claude Code skill
Flags repositories that disguise malicious downloads as legitimate security tools. Use it before installing software from GitHub.
npx skills add reason-machines/security-skills --skill security-threat-awareness -a claude-codeWhat security-threat-awareness does
The skill identifies warning signs in repositories that offer cracked software, keygens, pre-activated licenses, or commercial security products through unofficial channels. It also points to missing source code, artificial star activity, and attempts to imitate a trusted vendor. The risks it covers include trojans, credential stealers, ransomware, cryptominers, and botnet agents.
It includes a Python function that evaluates repository description and metadata, plus checklists for reviewing a project before download and responding after an accidental clone. The guidance covers signatures, ownership, commit history, community reports, and antivirus scans. Stop before execution when a repository offers a keygen or a pre-activated premium license; that is a concrete warning sign described by the skill.
What it helps with
- spot a repository distributing malicious software
- check a project for piracy-related indicators
- identify an unofficial antivirus repository
- assess suspicious star growth
- decide what to do after cloning a risky project
Example prompts for the agent
- Check this GitHub repository for signs of malicious software distribution and tell me what to do next.
- I found a repository offering a keygen for commercial antivirus software. Assess its warning signs.
- Write a repository check using the rules from security-threat-awareness.
How to install security-threat-awareness
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill security-threat-awareness -a claude-code2Manually: put the files in place
~/.claude/skills/security-threat-awareness/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/security-threat-awareness/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill security-threat-awareness -a codex2Manually: put the files in place
.agents/skills/security-threat-awareness/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill security-threat-awareness -a cursor2Manually: put the files in place
.cursor/skills/security-threat-awareness/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install reason-machines/security-skills security-threat-awareness2Manually: put the files in place
.github/skills/security-threat-awareness/SKILL.md1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill security-threat-awareness -a gemini-cli2Platform CLI
gemini skills install https://github.com/reason-machines/security-skills --path skills/security-threat-awarenessManually: put the files in place
.devin/skills/security-threat-awareness/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill security-threat-awareness -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about security-threat-awareness
How do I install security-threat-awareness in Claude Code?
Run npx skills add reason-machines/security-skills --skill security-threat-awareness -a claude-code, run the same command again, then check ~/.claude/skills/security-threat-awareness/SKILL.md.
What does security-threat-awareness do?
It helps identify repositories that disguise malicious downloads as legitimate security software. The skill checks for piracy signals, unofficial distribution, suspicious engagement, and missing source code.
Which platforms does this skill support?
It supports Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, and OpenCode.
