菜单
Identify, analyze, and document malware distribution repositories masquerading as legitimate software
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/Aradotso/security-skills --skill malware-detection-and-removal命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | malware-detection-and-removal |
| description | Identify, analyze, and document malware distribution repositories masquerading as legitimate software |
| triggers | ["detect malware repository patterns","analyze suspicious github projects","identify software piracy scams","check for malicious crack repositories","verify legitimate security software","investigate fake download repositories","scan for threat distribution channels","evaluate repository authenticity"] |
Skill by ara.so — Security Skills collection.
This project is NOT legitimate Bitdefender software. It is a malware distribution repository disguising itself as cracked security software. This skill documents how to identify and handle such threats.
This is a malicious repository that:
Suspicious Description Keywords:
Repository Characteristics:
Deceptive Naming:
package main
import (
"fmt"
"strings"
)
// RepositoryAnalysis contains threat indicators
type RepositoryAnalysis struct {
Name string
Description string
Topics []string
HasReadme bool
StarRate float64
ThreatScore int
}
// AnalyzeThreatLevel calculates risk score
func (r *RepositoryAnalysis) AnalyzeThreatLevel() int {
score := 0
// Check for crack/piracy keywords
crackKeywords := []string{"crack", "keygen", "loader", "pre-activated", "license key"}
for _, keyword := range crackKeywords {
if strings.Contains(strings.ToLower(r.Description), keyword) {
score += 20
}
}
// Check for bypass/exploit topics
dangerousTopics := []string{"defender-bypass", "thread-hijacking", "exploit-mitigation"}
for _, topic := range r.Topics {
for _, dangerous := range dangerousTopics {
if topic == dangerous {
score += 15
}
}
}
// High star rate with no content
if r.StarRate > 3 && !r.HasReadme {
score += 25
}
// No README is suspicious for "software" repo
if !r.HasReadme {
score += 20
}
return score
}
func main() {
repo := RepositoryAnalysis{
Name: "Bitdefender-Total-Security-Crack-2026",
Description: "Bitdefender Total Security Download | Crack | Keygen",
Topics: []string{"defender-bypass", "malware-scanner", "thread-hijacking"},
HasReadme: false,
StarRate: 4.0,
}
threatScore := repo.AnalyzeThreatLevel()
fmt.Printf("Repository: %s\n", repo.Name)
fmt.Printf("Threat Score: %d/100\n", threatScore)
if threatScore > 50 {
fmt.Println("⚠️ HIGH RISK: Likely malware distribution")
} else if threatScore > 30 {
fmt.Println("⚠️ MEDIUM RISK: Suspicious patterns detected")
} else {
fmt.Println("✓ Low risk")
}
}
package main
import (
"fmt"
"os"
"path/filepath"
)
// VerifyRepositoryContent checks for legitimate source code
func VerifyRepositoryContent(repoPath string) (bool, []string) {
issues := []string{}
hasSourceCode := false
// Check for actual code files
sourceExts := []string{".go", ".py", ".js", ".cpp", ".c"}
err := filepath.Walk(repoPath, func(path string, info os.FileInfo, err error) error {
if err != nil {
return err
}
if !info.IsDir() {
ext := filepath.Ext(path)
for _, sourceExt := range sourceExts {
if ext == sourceExt {
hasSourceCode = true
return nil
}
}
// Check for suspicious executables
if ext == ".exe" || ext == ".dll" || ext == ".bat" {
issues = append(issues, fmt.Sprintf("Suspicious executable: %s", path))
}
}
return nil
})
if err != nil {
issues = append(issues, fmt.Sprintf("Error scanning: %v", err))
}
if !hasSourceCode {
issues = append(issues, "No source code found - likely malware dropper")
}
return hasSourceCode, issues
}
Never clone or run code from suspicious repositories:
# DO NOT run these commands on suspicious repos:
# git clone <suspicious-repo>
# go run main.go
# ./setup.exe
# Instead, report the repository
GitHub Security Advisory:
Using GitHub API (with proper authentication):
package main
import (
"bytes"
"encoding/json"
"fmt"
"net/http"
"os"
)
type AbuseReport struct {
URL string `json:"url"`
Reason string `json:"reason"`
Details string `json:"details"`
}
func ReportMaliciousRepository(repoURL string) error {
// Use GitHub's abuse reporting
// Requires authentication via GITHUB_TOKEN env var
report := AbuseReport{
URL: repoURL,
Reason: "malware-distribution",
Details: "Repository distributing malware disguised as cracked software",
}
jsonData, err := json.Marshal(report)
if err != nil {
return err
}
// This is a conceptual example - GitHub abuse reports go through web form
fmt.Printf("Report prepared for: %s\n", repoURL)
fmt.Printf("Report details: %s\n", string(jsonData))
fmt.Println("Visit https://support.github.com/contact/report-abuse to submit")
return nil
}
Official Sources Only:
Verification Checklist:
package main
import (
"fmt"
"os/exec"
)
// VerifyCodeSignature checks Windows executable signature
func VerifyCodeSignature(filePath string) (bool, error) {
// Use PowerShell to verify signature
cmd := exec.Command("powershell", "-Command",
fmt.Sprintf("(Get-AuthenticodeSignature '%s').Status", filePath))
output, err := cmd.CombinedOutput()
if err != nil {
return false, err
}
status := string(output)
isValid := status == "Valid\n"
fmt.Printf("Signature status: %s", status)
return isValid, nil
}
This skill is for security research and education to help identify and report malware distribution channels. Never use information to create or distribute malware.