Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Detect and analyze potentially malicious security software crack/patch repositories
triggers
["analyze this k7 security repository","is this k7 patch repository safe","check if this security software repo is legitimate","detect malware distribution in antivirus cracks","identify fake security software repositories","analyze suspicious patch download sites","verify k7 total security repository authenticity","scan for trojan distribution in security tools"]
This skill helps AI agents identify and analyze potentially malicious repositories that claim to provide "unlock patches," "keygens," or "cracks" for legitimate security software. The repository described in the context is a high-risk malware distribution vector disguised as a security tool.
What This Repository Actually Is
Red Flags Identified
Malware Distribution Pattern: Claims to provide "unlock patch" for commercial antivirus software
No License: Legitimate open-source security tools have clear licenses
Future Date: Created "2026-06-17" indicates fabricated metadata
HTML Primary Language: Security tools are not written in HTML; this indicates a phishing/download page
Zero Forks/Issues: No genuine community engagement despite high star count
Keyword Stuffing: 14 similar topics all focusing on "k7-patch," "k7-key" for SEO manipulation
External Download Badge: Links to external site (29hinojosa.github.io) rather than GitHub releases
Threat Classification
threat_type:"Malware Distribution / Trojan Dropper"confidence:"HIGH"indicators:-software_crack_distribution-antivirus_bypass_attempt-credential_theft_vector-fake_github_repository-seo_keyword_stuffing
Detection Techniques
Repository Pattern Analysis
import re
from typing importDict, Listdefanalyze_repository_threat_indicators(repo_data: Dict) -> Dict:
"""
Analyze GitHub repository for malware distribution patterns.
Args:
repo_data: Repository metadata from GitHub API
Returns:
Threat assessment with risk score
"""
threat_score = 0
indicators = []
# Check for crack/patch/keygen keywords
crack_keywords = [
'crack', 'patch', 'keygen', 'unlock', 'activator',
'license-key', 'serial', 'activation'
]
description = repo_data.get('description', '').lower()
topics = [t.lower() for t in repo_data.get('topics', [])]
# Keyword stuffing detection
keyword_matches = sum(1for kw in crack_keywords if kw in description orany(kw in t for t in topics))
if keyword_matches >= 3:
threat_score += 40
indicators.append("crack_keyword_stuffing")
# Check for repeated similar topicsiflen(topics) > 10andlen(set(topics)) / len(topics) < 0.5:
threat_score += 25
indicators.append("topic_keyword_stuffing")
# HTML as primary language for "security tool"if repo_data.get('language') == 'HTML':
threat_score += 20
indicators.append("suspicious_primary_language")
# No license for security softwareifnot repo_data.get('license'):
threat_score += 15
indicators.append("missing_license")
# Artificial star growth
stars = repo_data.get('stargazers_count', 0)
forks = repo_data.get('forks', 0)
if stars > 100and forks == 0:
threat_score += 30
indicators.append("artificial_engagement")
# Future creation datefrom datetime import datetime
created = datetime.fromisoformat(repo_data.get('created_at', '').replace('Z', '+00:00'))
if created > datetime.now(created.tzinfo):
threat_score += 50
indicators.append("future_timestamp_fraud")
return {
'threat_score': min(threat_score, 100),
'risk_level': 'CRITICAL'if threat_score >= 70else'HIGH'if threat_score >= 50else'MEDIUM',
'indicators': indicators,
'is_malicious': threat_score >= 50
}
# Example usage
repo_metadata = {
'description': 'K7 Total Security 16.0.1195 Full ToolKit 2026 Edition',
'language': 'HTML',
'topics': ['k7-patch', 'k7-key', 'k7-total-security-patch', 'k7-unlock'],
'license': None,
'stargazers_count': 182,
'forks': 0,
'created_at': '2026-06-17T21:05:03Z'
}
assessment = analyze_repository_threat_indicators(repo_metadata)
print(f"Risk Level: {assessment['risk_level']}")
print(f"Threat Score: {assessment['threat_score']}/100")
print(f"Indicators: {', '.join(assessment['indicators'])}")
README Content Analysis
import re
from typing importSetdefextract_malware_indicators_from_readme(readme_content: str) -> Set[str]:
"""
Parse README for common malware distribution patterns.
Args:
readme_content: Raw README markdown content
Returns:
Set of detected malware indicators
"""
indicators = set()
# External download links (not GitHub releases)
external_links = re.findall(r'https?://(?!github\.com|githubusercontent\.com)([^\s\)]+)', readme_content)
if external_links:
indicators.add("external_download_links")
# Obfuscated commands or PowerShell download patterns
powershell_patterns = [
r'IEX\s*\(',
r'Invoke-WebRequest',
r'wget.*\|.*sh',
r'curl.*\|.*bash'
]
for pattern in powershell_patterns:
if re.search(pattern, readme_content, re.IGNORECASE):
indicators.add("suspicious_download_command")
break# Fake legitimacy indicatorsif'MIT License'in readme_content and'not host, distribute, or provide access'in readme_content:
indicators.add("contradictory_license_disclaimer")
# Claims of "AI integration" for simple toolsif re.search(r'OpenAI|Claude|GPT-4', readme_content) and'patch'in readme_content.lower():
indicators.add("fake_ai_feature_complexity")
# Excessive feature bloat for a "patch"
feature_sections = len(re.findall(r'^#{2,3}\s+', readme_content, re.MULTILINE))
if feature_sections > 15:
indicators.add("excessive_fake_documentation")
return indicators
# Example usage
readme_sample = """
[](https://29hinojosa.github.io/K7-Total-Security-Unlock-Patch-16-0-1195/)
ai_integration:
incident_analysis:
provider: "openai"
model: "gpt-4-turbo"
"""
indicators = extract_malware_indicators_from_readme(readme_sample)
print(f"Malware indicators detected: {', '.join(indicators)}")
Safe Analysis Workflow
Never Execute Downloaded Content
#!/bin/bash# SAFE: Analyze repository without execution# Clone to isolated directory (NO EXECUTION)
git clone https://github.com/29Hinojosa/K7-Total-Security-Unlock-Patch-16-0-1195 /tmp/analysis_quarantine
cd /tmp/analysis_quarantine
# Scan for suspicious file types
find . -type f \( -name "*.exe" -o -name "*.dll" -o -name "*.scr" -o -name "*.bat" -o -name "*.vbs" \) -ls# Check for obfuscated scripts
grep -r "eval\|exec\|base64" . --include="*.js" --include="*.ps1" --include="*.sh"# Analyze HTML for redirect/download triggers
grep -r "window.location\|document.write\|<meta.*refresh" . --include="*.html"# CRITICAL: Delete after analysiscd /tmp
rm -rf /tmp/analysis_quarantine
# Report to GitHub Trust & Safety# Navigate to: https://github.com/contact/report-abuse# Select: "Report a repository"# Category: "Malware distribution"# Evidence: Provide threat analysis output# Alternative: Command-line report (requires gh CLI)
gh api \
--method POST \
-H "Accept: application/vnd.github+json" \
/repos/29Hinojosa/K7-Total-Security-Unlock-Patch-16-0-1195/issues \
-f title='[SECURITY] Malware Distribution' \
-f body='This repository distributes malware disguised as security software patches. See analysis: [evidence]'
User Protection Response
// Browser extension snippet to warn usersfunctiondetectMaliciousSecurityRepo() {
const url = window.location.href;
const repoPattern = /github\.com\/[\w-]+\/(.*?(crack|patch|keygen|unlock).*?(security|antivirus|firewall))/i;
if (repoPattern.test(url)) {
const warning = document.createElement('div');
warning.style.cssText = 'position:fixed;top:0;left:0;right:0;background:#d32f2f;color:white;padding:20px;z-index:99999;text-align:center;font-size:16px;';
warning.innerHTML = `
⚠️ <strong>SECURITY WARNING</strong>: This repository claims to provide cracks/patches for security software.
Such repositories commonly distribute malware. DO NOT download or execute any files.
`;
document.body.prepend(warning);
}
}
// Run on page loadif (document.readyState === 'loading') {
document.addEventListener('DOMContentLoaded', detectMaliciousSecurityRepo);
} else {
detectMaliciousSecurityRepo();
}
Legitimate Alternatives
For K7 Total Security Users
## Official K7 Computing Resources-**Official Website**: https://www.k7computing.com/
-**Official Support**: https://support.k7computing.com/
-**Free Trial**: Available through official site only
-**License Purchase**: Only through k7computing.com or authorized resellers
⚠️ K7 Computing does NOT distribute:
- Unlock patches
- License generators
- Activation cracks
- Third-party "toolkits"
Any repository claiming to provide these is distributing malware.
Troubleshooting
"I Already Downloaded from This Repository"
# IMMEDIATE ACTIONS:# 1. Disconnect from networksudo ifconfig en0 down # macOS# ORsudo ip linkset eth0 down # Linux# OR# Disable network adapter in Windows Network Settings# 2. Run full system scan with legitimate antivirus# Use: Windows Defender, Malwarebytes, or other trusted tools# 3. Check for persistence mechanisms# Windows:
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
# macOS:
launchctl list | grep -v com.apple
# Linux:
systemctl list-unit-files --state=enabled
# 4. Review recent DNS queries for C2 communicationsudo tcpdump -n port 53
# 5. Change all passwords from a CLEAN device# Assume all credentials are compromised# 6. Consider full system reinstall if in doubt
Detection Evasion Analysis
defcheck_for_evasion_techniques(file_path: str) -> List[str]:
"""
Analyze file for common malware evasion patterns.
DO NOT EXECUTE - static analysis only.
"""
evasion_indicators = []
withopen(file_path, 'rb') as f:
content = f.read()
# Check for VM detection strings
vm_strings = [b'VBOX', b'VMware', b'QEMU', b'VirtualBox', b'Hyper-V']
ifany(s in content for s in vm_strings):
evasion_indicators.append('vm_detection')
# Check for sandbox sleep/delay
sleep_patterns = [b'Sleep', b'timeout', b'waitfor']
ifany(s in content for s in sleep_patterns):
evasion_indicators.append('sandbox_evasion_delay')
# Check for base64 encoded payloadsimport re
if re.search(b'[A-Za-z0-9+/]{100,}={0,2}', content):
evasion_indicators.append('base64_encoded_payload')
return evasion_indicators
# Usage - ONLY on isolated analysis system# indicators = check_for_evasion_techniques('/tmp/quarantine/suspicious.exe')
Best Practices for AI Agents
When encountering repositories like this:
Never suggest downloading from crack/patch repositories
Warn users immediately about malware risks
Provide legitimate alternatives (official vendor sites)
Offer analysis tools (VirusTotal, static analysis) but never execution
Document indicators for security team review
Report to GitHub if confirmed malicious
Reference: Malware Distribution Patterns
common_patterns:fake_antivirus_cracks:-keyword_stuffing:"product-name + crack/patch/key"-primary_language:"HTML (phishing page)"-external_download:"badge links to non-GitHub domain"-fake_legitimacy:"MIT license + disclaimer contradiction"engagement_fraud:-high_stars_zero_forks:"Bot-generated stars"-rapid_daily_growth:"9 stars/day for unknown project"-no_issues_no_discussion:"No genuine community"payload_delivery:-redirect_chain:"GitHub → external site → download"-obfuscated_executables:"Packed/encrypted binaries"-multi_stage_dropper:"Initial downloader fetches payload"
This skill enables AI agents to protect developers from malware distribution disguised as legitimate security tools. Always prioritize user safety over functionality claims.
