Agent skill · security · aradotso
malware-analysis-detection
malware-analysis-detection — an agent skill for coding agents.
Why this skill is useful
Includes executable scripts for detecting malware patterns and analyzing repository security risks that the AI wouldn't generate on its own.
What it needs
Requires go installed locally. About 3k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
go package malwaredetector type RepoAnalysis struct { SuspiciousTopics []string EmptyReadme bool CrackKeywords []string ArtificialStars bool ImpersonatedBrand string RiskLevel string } func AnalyzeRepository(repo Repository) RepoAnalysis { analysis := RepoAnalysis{} // Check for piracy keywords crackKeywords := []string{ "crack", "keygen", "loader", "pre-activated", "license key", "full version", "activation", } for , keyword := range crackKeywords { if containsIgnoreCase(repo.Description, keyword) { analysis.CrackKeywords = append(analysis.CrackKeywords, keyword) } } // Check for malicious topics maliciousTopics := []string{ "defender-bypass", "thread-hijacking", "exploit-mitigation", "rootkit-remover", } for , topic := range repo.Topics { for , malTopic := range maliciousTopics { if topic == malTopic { analysis.SuspiciousTopics = append(analysis.SuspiciousTopics, topic) } } } // Check README analysis.EmptyReadme = len(repo.Readme) < 100 // Determine risk level riskScore := 0 if len(analysis.CrackKeywords) > 3 { riskScore += 40 } if len(analysis.SuspiciousTopics) > 2 { riskScore += 30 } if analysis.EmptyReadme { riskScore += 20 } if repo.StarGrowthRate > 3 { riskScore += 10 } switch { case riskScore >= 80: analysis.RiskLevel = "CRITICAL - Confirmed Malware Distribution" case riskScore >= 60: analysis.RiskLevel = "HIGH - Likely Malicious" case riskScore >= 40: analysis.RiskLevel = "MEDIUM - Suspicious Activity" default: analysis.RiskLevel = "LOW - Monitor" } return analysis } go package detector import ( "regexp" "strings" ) var malwarePatterns = map[string]regexp.Regexp{ "crackdistribution": regexp.MustCompile((?i)(crack cracked keygen patch loader activator)), "fakelicenses": regexp.MustCompile((?i)(license\s+key serial\s+number activation\s+code product\s+key)), "bypasssecurity": regexp.MustCompile((?i)(bypass disable remove crack)\s+(antivirus defender firewall protection)), "trojanindicators": regexp.MustCompile((?i)(inject payload backdoor remote\s+access stea …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/malware-analysis-detection