# security-threat-awareness

Flags repositories that disguise malicious downloads as legitimate security tools. Use it before installing software from GitHub.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1000 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/security-threat-awareness/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/security-threat-awareness

## What it does

The skill identifies warning signs in repositories that offer cracked software, keygens, pre-activated licenses, or commercial security products through unofficial channels. It also points to missing source code, artificial star activity, and attempts to imitate a trusted vendor. The risks it covers include trojans, credential stealers, ransomware, cryptominers, and botnet agents.

It includes a Python function that evaluates repository description and metadata, plus checklists for reviewing a project before download and responding after an accidental clone. The guidance covers signatures, ownership, commit history, community reports, and antivirus scans. Stop before execution when a repository offers a keygen or a pre-activated premium license; that is a concrete warning sign described by the skill.

## Requirements
- Works with: GitHub

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-threat-awareness -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/security-threat-awareness/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/security-threat-awareness/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-threat-awareness -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/security-threat-awareness/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-threat-awareness -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/security-threat-awareness/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills security-threat-awareness
```

2. **Manually: put the files in place**
- File: `.github/skills/security-threat-awareness/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-threat-awareness -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/security-threat-awareness
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/security-threat-awareness/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-threat-awareness -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/security-threat-awareness/SKILL.md

## When to use it
- spot a repository distributing malicious software
- check a project for piracy-related indicators
- identify an unofficial antivirus repository
- assess suspicious star growth
- decide what to do after cloning a risky project

## Example prompts
- Check this GitHub repository for signs of malicious software distribution and tell me what to do next.
- I found a repository offering a keygen for commercial antivirus software. Assess its warning signs.
- Write a repository check using the rules from security-threat-awareness.

## Similar
- [saas-security-posture](https://affpapa.org/en/nevibecode/skills/saas-security-posture.md) — skill · 314 installs
- [threat-modeling-with-aws-security-agent](https://affpapa.org/en/nevibecode/skills/threat-modeling-with-aws-security-agent.md) — skill · 1600 installs
- [repo-security-posture](https://affpapa.org/en/nevibecode/skills/repo-security-posture.md) — skill · 853 installs
- [ci-cd-security](https://affpapa.org/en/nevibecode/skills/ci-cd-security.md) — skill · 7900 installs
- [make-repo-contribution](https://affpapa.org/en/nevibecode/skills/make-repo-contribution.md) — skill · 11073 installs
- [dependabot](https://affpapa.org/en/nevibecode/skills/dependabot.md) — skill · 4400 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 17 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md