security-awareness-malware-detection

Imported from reason-machines/security-skills (skills/security-awareness-malware-detection/SKILL.md). Install upstream with npx skills add reason-machines/security-skills --skill security-awareness-malware-detection. Copyright stays with the author.

---
name: security-awareness-malware-detection
description: Identify and analyze potentially malicious software distribution repositories and security threats
triggers:
  - check if this repository is distributing malware
  - analyze this project for security risks
  - is this a legitimate software distribution
  - detect pirated software repositories
  - identify keygen or crack distribution
  - scan for malicious GitHub projects
  - verify software authenticity
  - check for fake antivirus distributions
---

# Security Awareness: Malware Detection

> Skill by [ara.so](https://ara.so) — Security Skills collection.

## ⚠️ CRITICAL SECURITY WARNING

This repository exhibits **multiple red flags indicating malicious intent**:

### Threat Indicators

1. **Pirated Software Distribution**: Offers "cracked" commercial antivirus with keygens, loaders, and pre-activated licenses
2. **Trademark Abuse**: Unauthorized use of Avast brand name and intellectual property
3. **Social Engineering**: Uses stars/engagement manipulation (60 stars in 10 days suggests artificial inflation)
4. **Missing Content**: No README or source code despite claiming to be a "Go" project
5. **Suspicious Topics**: Tags like "premium-cleaner", "retdec" mixed with piracy-related terms
6. **Future Dating**: Claims "2026" version (impossible/deceptive)
7. **No License**: NOASSERTION license status for commercial software redistribution

### Attack Vectors

Projects like this typically:
- **Bundle malware** with legitimate-looking installers
- **Steal credentials** through fake activation processes
- **Install backdoors** disguised as security software
- **Harvest system information** during "verification"
- **Deploy ransomware** after gaining system access

## What AI Agents Should Do

### Detection Protocol

When encountering suspicious repositories:

```python
# Pseudocode for threat assessment
def assess_repository_threat(repo):
    red_flags = []
    
    # Check for piracy indicators
    piracy_keywords = ['keygen', 'crack', 'loader', 'pre-activated', 
                       'serial', 'license key', 'full version']
    if any(kw in repo.description.lower() for kw in piracy_keywords):
        red_flags.append("PIRACY_DISTRIBUTION")
    
    # Check for missing source code
    if repo.language and not repo.has_code:
        red_flags.append("NO_SOURCE_CODE")
    
    # Check for trademark abuse
    if uses_commercial_brand_without_affiliation(repo):
        red_flags.append("TRADEMARK_ABUSE")
    
    # Check star velocity
    if repo.stars_per_day > 5 and repo.age_days < 30:
        red_flags.append("SUSPICIOUS_ENGAGEMENT")
    
    return red_flags

Recommended Response

# DO NOT clone or download from suspicious repositories
# DO NOT execute any binaries or scripts
# DO NOT provide installation instructions

# Instead, report the repository:
# 1. GitHub: Report via repository page
# 2. Brand owner: Contact Avast security team
# 3. User: Warn about security risks

Legitimate Security Software Practices

How to Verify Authentic Software

# Always download from official sources
# For Avast specifically:
OFFICIAL_SITE="https://www.avast.com"

# Verify digital signatures
# On Windows:
signtool verify /pa /v "downloaded_installer.exe"

# Check file hashes against official checksums
sha256sum downloaded_installer.exe
# Compare with hash published on official website

Safe Software Installation Pattern

// Example of proper software verification in Go
package main

import (
    "crypto/sha256"
    "fmt"
    "io"
    "os"
)

func verifyFileIntegrity(filepath string, expectedHash string) (bool, error) {
    f, err := os.Open(filepath)
    if err != nil {
        return false, err
    }
    defer f.Close()

    h := sha256.New()
    if _, err := io.Copy(h, f); err != nil {
        return false, err
    }

    actualHash := fmt.Sprintf("%x", h.Sum(nil))
    return actualHash == expectedHash, nil
}

func main() {
    // Only download from official sources
    officialDownloadURL := os.Getenv("OFFICIAL_SOFTWARE_URL")
    expectedSHA256 := os.Getenv("OFFICIAL_SHA256_HASH")
    
    // Verify before execution
    valid, err := verifyFileIntegrity("installer.exe", expectedSHA256)
    if err != nil || !valid {
        fmt.Println("SECURITY WARNING: File integrity check failed!")
        os.Exit(1)
    }
}

User Protection Guidance

What to Tell Users

❌ **DO NOT USE THIS REPOSITORY**

This project is distributing:
- Pirated commercial software
- Potentially malicious "cracks" or "keygens"
- Unauthorized modifications to security software

### Risks:
- Malware infection
- Data theft
- System compromise
- Legal liability

### Safe Alternative:
Download Avast from official source: https://www.avast.com
Use official free version or purchase legitimate license

Reporting Malicious Content

# GitHub abuse reporting
# Navigate to repository → Report content → Select violation type

# For this specific case:
VIOLATION_TYPES=(
    "Malware distribution"
    "Pirated content"
    "Trademark infringement"
    "Deceptive content"
)

Security Best Practices for AI Agents

Never Provide Installation Help For:

• Cracked software
• Keygen tools
• License bypass mechanisms
• Unauthorized software modifications
• Repositories with no legitimate source code

Always Warn Users About:

• Legal risks of software piracy
• Security risks of untrusted executables
• Trademark/copyright violations
• Potential malware delivery mechanisms

Recommended Action Pattern

def handle_suspicious_software_request(user_request):
    if contains_piracy_indicators(user_request):
        return {
            "action": "DENY_AND_EDUCATE",
            "response": """
            ⚠️ Security Warning: This appears to be pirated software.
            
            Risks:
            - Malware/ransomware infection
            - Data theft and privacy violation
            - Legal consequences
            
            Safe alternative: Use official software from verified sources.
            Many vendors offer free tiers or trial versions.
            """
        }

Conclusion

This repository is NOT a legitimate open source project. It's a malware distribution vector using GitHub's platform to appear credible. AI agents should:

1. Refuse to provide usage instructions
2. Warn users about security risks
3. Recommend official alternatives
4. Encourage reporting the repository

Protecting users from security threats is paramount to providing technical assistance for malicious projects.