Security Awareness Malicious Repository Detection

This teaches Claude to spot malware repos disguised as software cracks by analyzing repo metadata for red flags. It includes Go code that scores repositories based on suspicious keywords (crack, keygen, pre-activated), exploit terminology (defender-bypass, thread-hijacking), and the dangerous combo of legitimate security vendor names plus piracy terms. The detection logic is straightforward: anything scoring 50+ risk points gets flagged. Honestly most useful as a reference implementation if you're building automated scanning tools or want to understand common malware distribution patterns on GitHub. The specific example it analyzes (a fake Bitdefender crack repo) drives home how these attacks work through social engineering rather than technical sophistication.

Install to Claude Code

npx -y skills add aradotso/security-skills --skill security-awareness-malicious-repository-detection --agent claude-code