Agent skill · security · aradotso
security-awareness-malicious-repository-identification
security-awareness-malicious-repository-identification — an agent skill for coding agents.
Why this skill is useful
Provides specific heuristics and patterns for identifying malicious repositories that the AI wouldn't reliably generate on its own.
What it needs
About 4k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
Description keywords: "Crack" "Keygen Loader" "Pre-Activated" "Full Version License Key" yaml Stars: 59 (4 stars/day) # Artificially inflated Forks: 0 # No legitimate development Open Issues: 0 # No community interaction No README # No documentation License: NOASSERTION # Avoiding legal scrutiny Topics include: "defender-bypass" # Explicit security evasion "thread-hijacking" # Attack technique "exploit-mitigation" # Misused security term python Malicious repository detection heuristics def analyzerepositoryrisk(repodata): riskscore = 0 redflags = [] # Check for crack/keygen keywords suspiciouskeywords = [ 'crack', 'keygen', 'loader', 'pre-activated', 'full version', 'license key', 'bypass' ] description = repodata.get('description', '').lower() for keyword in suspiciouskeywords: if keyword in description: riskscore += 10 redflags.append(f"Suspicious keyword: {keyword}") # Check star/fork ratio stars = repodata.get('stars', 0) forks = repodata.get('forks', 0) if stars > 20 and forks == 0: riskscore += 15 redflags.append("Unusual star/fork ratio (likely fake stars)") # Check for missing README if not repodata.get('hasreadme', True): riskscore += 5 redflags.append("No README provided") # Check for contradictory security claims if 'antivirus' in description and 'bypass' in description: riskscore += 20 redflags.append("Contradictory security claims") # Assess risk level if riskscore >= 30: return "HIGH RISK - LIKELY MALICIOUS", redflags elif riskscore >= 15: return "MEDIUM RISK - INVESTIGATE FURTHER", redflags else: return "LOW RISK", redflags Example usage repo = { 'description': 'Bitdefender Total Security Crack Keygen Loader Defender Bypass', 'stars': 59, 'forks': 0, 'hasreadme': False } risklevel, flags = analyzerepositoryrisk(repo) print(f"Risk Level: {risklevel}") for flag in flags: print(f" - {flag}") bash Check repository metadata curl -H "Authorization: token ${GITHUBTOKEN}" \ https://api.github.com/repos/MistDuckCount/Bitdefender-Total-Security-Crack-2026 Analy …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/security-awareness-malicious-repository-identification