القائمة
Identify, analyze, and document malware distribution repositories masquerading as legitimate software
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/Aradotso/security-skills --skill malware-detection-and-removalيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | malware-detection-and-removal |
| description | Identify, analyze, and document malware distribution repositories masquerading as legitimate software |
| triggers | ["detect malware repository patterns","analyze suspicious github projects","identify software piracy scams","check for malicious crack repositories","verify legitimate security software","investigate fake download repositories","scan for threat distribution channels","evaluate repository authenticity"] |
Skill by ara.so — Security Skills collection.
This project is NOT legitimate Bitdefender software. It is a malware distribution repository disguising itself as cracked security software. This skill documents how to identify and handle such threats.
This is a malicious repository that:
Suspicious Description Keywords:
Repository Characteristics:
Deceptive Naming:
package main
import (
"fmt"
"strings"
)
// RepositoryAnalysis contains threat indicators
type RepositoryAnalysis struct {
Name string
Description string
Topics []string
HasReadme bool
StarRate float64
ThreatScore int
}
// AnalyzeThreatLevel calculates risk score
func (r *RepositoryAnalysis) AnalyzeThreatLevel() int {
score := 0
// Check for crack/piracy keywords
crackKeywords := []string{"crack", "keygen", "loader", "pre-activated", "license key"}
for _, keyword := range crackKeywords {
if strings.Contains(strings.ToLower(r.Description), keyword) {
score += 20
}
}
// Check for bypass/exploit topics
dangerousTopics := []string{"defender-bypass", "thread-hijacking", "exploit-mitigation"}
for _, topic := range r.Topics {
for _, dangerous := range dangerousTopics {
if topic == dangerous {
score += 15
}
}
}
// High star rate with no content
if r.StarRate > 3 && !r.HasReadme {
score +=
}
!r.HasReadme {
score +=
}
score
}
{
repo := RepositoryAnalysis{
Name: ,
Description: ,
Topics: []{, , },
HasReadme: ,
StarRate: ,
}
threatScore := repo.AnalyzeThreatLevel()
fmt.Printf(, repo.Name)
fmt.Printf(, threatScore)
threatScore > {
fmt.Println()
} threatScore > {
fmt.Println()
} {
fmt.Println()
}
}
package main
import (
"fmt"
"os"
"path/filepath"
)
// VerifyRepositoryContent checks for legitimate source code
func VerifyRepositoryContent(repoPath string) (bool, []string) {
issues := []string{}
hasSourceCode := false
// Check for actual code files
sourceExts := []string{".go", ".py", ".js", ".cpp", ".c"}
err := filepath.Walk(repoPath, func(path string, info os.FileInfo, err error) error {
if err != nil {
return err
}
if !info.IsDir() {
ext := filepath.Ext(path)
for _, sourceExt := range sourceExts {
if ext == sourceExt {
hasSourceCode = true
return nil
}
}
// Check for suspicious executables
if ext == ".exe" || ext == ".dll" || ext == ".bat" {
issues = append(issues, fmt.Sprintf("Suspicious executable: %s", path))
}
}
return
})
err != {
issues = (issues, fmt.Sprintf(, err))
}
!hasSourceCode {
issues = (issues, )
}
hasSourceCode, issues
}
Never clone or run code from suspicious repositories:
# DO NOT run these commands on suspicious repos:
# git clone <suspicious-repo>
# go run main.go
# ./setup.exe
# Instead, report the repository
GitHub Security Advisory:
Using GitHub API (with proper authentication):
package main
import (
"bytes"
"encoding/json"
"fmt"
"net/http"
"os"
)
type AbuseReport struct {
URL string `json:"url"`
Reason string `json:"reason"`
Details string `json:"details"`
}
func ReportMaliciousRepository(repoURL string) error {
// Use GitHub's abuse reporting
// Requires authentication via GITHUB_TOKEN env var
report := AbuseReport{
URL: repoURL,
Reason: "malware-distribution",
Details: "Repository distributing malware disguised as cracked software",
}
jsonData, err := json.Marshal(report)
if err != nil {
return err
}
// This is a conceptual example - GitHub abuse reports go through web form
fmt.Printf("Report prepared for: %s\n", repoURL)
fmt.Printf("Report details: %s\n", string(jsonData))
fmt.Println("Visit https://support.github.com/contact/report-abuse to submit")
return nil
}
Official Sources Only:
Verification Checklist:
package main
import (
"fmt"
"os/exec"
)
// VerifyCodeSignature checks Windows executable signature
func VerifyCodeSignature(filePath string) (bool, error) {
// Use PowerShell to verify signature
cmd := exec.Command("powershell", "-Command",
fmt.Sprintf("(Get-AuthenticodeSignature '%s').Status", filePath))
output, err := cmd.CombinedOutput()
if err != nil {
return false, err
}
status := string(output)
isValid := status == "Valid\n"
fmt.Printf("Signature status: %s", status)
return isValid, nil
}
This skill is for security research and education to help identify and report malware distribution channels. Never use information to create or distribute malware.