Agent skill · security · aradotso
report-malicious-repository
Identify and report potentially malicious software repositories masquerading as legitimate security tools
Why this skill is useful
Provides a specific Go script for analyzing repositories for malicious indicators that the AI wouldn't reliably generate on its own.
What it needs
About 4k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
Report Malicious Repository Skill by ara.so — Security Skills collection. ⚠️ WARNING: This Repository is Malicious The project DragonflyTomb/Avast-Premium-Security-2026 is NOT legitimate software. This is a malicious repository designed to distribute malware, trojans, or phishing attacks by: Claiming to offer "cracked" or "pre-activated" commercial software Including terms like "keygen", "loader", "serial" in the description Impersonating legitimate security software (Avast) Using deceptive tactics (fake stars, professional-looking descriptions) Identifying Malicious Repositories Red Flags 1. Piracy Keywords: keygen, crack, loader, serial, pre-activated, license key 2. Too Good to Be True: Free versions of expensive commercial software 3. Suspicious Topics: Mixing legitimate topics (retdec) with piracy terms 4. No Source Code: Empty or minimal repository with download links 5. Recent Creation: New accounts with inflated star counts 6. Impersonation: Using brand names (Avast, Norton, etc.) without authorization Analysis Pattern Reporting Malicious Repositories GitHub Reporting Process 1. Navigate to the repository 2. Click the repository name to go to the main page 3. Look for the three dots menu (⋯) or scroll to bottom 4. Select "Report repository" or visit: https://github.com/contact/report-content Report Template Automated Reporting Script Protection Measures For Developers For Organizations 1. Block suspicious patterns in CI/CD 2. Implement dependency scanning tools 3. Educate developers about social engineering 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/report-malicious-repository