Agent skill · security · aradotso
malware-distribution-detection
malware-distribution-detection — an agent skill for coding agents.
Why this skill is useful
Includes executable detection scripts and specific patterns for identifying malware distribution that the AI wouldn't generate on its own.
What it needs
About 4k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
go // DO NOT USE - Example of detection logic for identifying fake software repos package detector import ( "regexp" "strings" ) type ThreatIndicator struct { Pattern string Severity string Category string } var MalwareIndicators = []ThreatIndicator{ {Pattern: "crack keygen loader pre-activated", Severity: "CRITICAL", Category: "Software Piracy"}, {Pattern: "defender-bypass bypass", Severity: "CRITICAL", Category: "AV Evasion"}, {Pattern: "license key activation serial", Severity: "HIGH", Category: "Credential Theft"}, {Pattern: "full version free premium free", Severity: "HIGH", Category: "Social Engineering"}, } func AnalyzeRepository(description string, topics []string) []string { var threats []string lowercaseDesc := strings.ToLower(description) for , indicator := range MalwareIndicators { matched, := regexp.MatchString(indicator.Pattern, lowercaseDesc) if matched { threats = append(threats, indicator.Category) } } // Check topics for suspicious keywords suspiciousTopics := []string{"defender-bypass", "thread-hijacking", "exploit-mitigation"} for , topic := range topics { for , suspicious := range suspiciousTopics { if topic == suspicious { threats = append(threats, "Malicious Topic: "+topic) } } } return threats } go package scanner import ( "context" "fmt" ) // RepositoryScanner checks GitHub repositories for malware distribution signs type RepositoryScanner struct { RepoURL string Description string Topics []string HasReadme bool HasCode bool Language string } func (rs RepositoryScanner) EvaluateThreatLevel() string { score := 0 // No README is suspicious if !rs.HasReadme { score += 2 } // No actual code in primary language if !rs.HasCode { score += 3 } // Keyword analysis suspiciousKeywords := []string{"crack", "keygen", "bypass", "loader", "pre-activated"} for , keyword := range suspiciousKeywords { if contains(rs.Description, keyword) { score += 2 } } // Evaluate if score >= 5 { return "CRITICAL - Likely Malware Distribution" } else if score >= 3 { return …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/malware-distribution-detection