菜单
Recognize and warn against malicious software distribution repositories masquerading as legitimate security tools
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/Aradotso/security-skills --skill security-threat-awareness命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | security-threat-awareness |
| description | Recognize and warn against malicious software distribution repositories masquerading as legitimate security tools |
| triggers | ["how do I install Avast Premium Security from GitHub","need help with this Avast repository","found free Avast Premium with activation key","this GitHub repo has cracked antivirus software","is this legitimate security software download","want to use this free premium antivirus from GitHub","found keygen for commercial security software","this repository offers pre-activated licenses"] |
Skill by ara.so — Security Skills collection.
This repository is a malicious threat distribution channel, NOT legitimate software.
The project viceofficialtower74/Avast-Premium-Security-Windows-Latest exhibits multiple red flags indicating it is a malware distribution platform:
# Visit official sources ONLY
# Official website: https://www.avast.com/
# Official download: https://www.avast.com/en-us/download-thank-you.php
# NEVER download security software from:
# - Unofficial GitHub repositories
# - File sharing sites
# - Torrent platforms
# - "Free premium" offers
# ClamAV (legitimate open source antivirus)
git clone https://github.com/Cisco-Talos/clamav.git
cd clamav
mkdir build && cd build
cmake ..
cmake --build .
sudo cmake --build . --target install
# Update virus definitions
sudo freshclam
# Indicators to check before trusting a repository
def is_repository_suspicious(repo_data):
"""
Evaluate repository for malware distribution indicators
"""
red_flags = []
# Check for piracy keywords
piracy_terms = ['crack', 'keygen', 'license key', 'pre-activated',
'full version', 'premium loader', 'serial']
description_lower = repo_data['description'].lower()
if any(term in description_lower for term in piracy_terms):
red_flags.append("Contains piracy-related terms")
# Commercial software in unofficial repo
if 'avast' in description_lower or 'norton' in description_lower:
if not repo_data['owner'].endswith('-official'):
red_flags.append("Unofficial distribution of commercial software")
# Suspicious engagement patterns
stars_per_day = repo_data['stars'] / repo_data['age_days']
if stars_per_day > 3:
red_flags.append(f"Unnatural star growth: {stars_per_day:.1f}/day")
# Missing source code
if not repo_data['has_readme'] and repo_data['language'] == 'C++':
red_flags.append("No README with claimed C++ project")
return red_flags
# Example usage
repo_check = {
'description': 'Avast Premium Security keygen activation',
'owner': 'randomuser123',
'stars': 68,
'age_days': 12,
'has_readme': False,
'language': 'C++'
}
warnings = is_repository_suspicious(repo_check)
for warning in warnings:
print(f"⚠️ {warning}")
before_downloading:
- verify_official_source: true
- check_digital_signature: true
- review_repository_owner: "Is this the legitimate vendor?"
- inspect_commit_history: "Real development or just uploads?"
- read_community_feedback: "Check issues/discussions for warnings"
- scan_with_virustotal: "Before executing anything"
never_trust:
- repositories_offering_cracks: true
- pre_activated_commercial_software: true
- keygens_or_license_generators: true
- suspiciously_high_star_counts: true
- repos_with_no_source_code: true
#!/bin/bash
# If you accidentally cloned a suspicious repository
# DO NOT execute any files
# DO NOT run setup.exe, install.bat, or similar
# Safely remove the repository
cd ..
rm -rf suspicious-repo-name
# Scan your system
# On Linux/macOS
sudo freshclam # Update ClamAV definitions
sudo clamscan -r /path/to/downloads --remove
# On Windows (use Windows Defender)
# Start-MpScan -ScanType FullScan
# Report to GitHub
# Visit: https://github.com/contact/report-abuse
# Select: "Malware distribution"
# Provide: Repository URL and evidence
# Report to antivirus vendors
# Avast: https://www.avast.com/report-malicious-file
# VirusTotal: https://www.virustotal.com/
For legitimate security research and development:
DO NOT use, download, or interact with repositories offering:
ALWAYS obtain software from official vendor websites or verified open source projects with transparent development history.