identify-malicious-repository

Analyze GitHub repository metadata to detect fraudulent software distribution risks.

11|1|Updated May 16, 2026

Search Tags:#github #scam detection #repository analysis #malware #risk scoring #brand impersonation #cyber safety

Ready to run

npx skills add https://github.com/Aradotso/security-skills --skill identify-malicious-repository

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: identify-malicious-repository
Source: https://github.com/Aradotso/security-skills/tree/main/skills/identify-malicious-repository
Command: npx skills add https://github.com/Aradotso/security-skills --skill identify-malicious-repository

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you detect fraudulent GitHub repositories that impersonate legitimate security products in order to trick you into downloading malware.

Core Features & Use Cases

Repository risk detection: Scores likelihood of malicious intent using signals like piracy/cracking language, suspicious engagement patterns, and brand impersonation.
Actionable warnings and guidance: Produces a risk level plus specific red flags and a clear recommendation not to download.
Defensive follow-ups: Offers steps for reporting, system scanning, and basic IoC-oriented checks after exposure.

Use case example: You find a newly created “Avast Premium Security” repository with “keygen” style claims and inflated stars but no real engagement; this skill helps you identify it as likely malicious and avoid downloading.

Quick Start

Use the identify-malicious-repository skill to analyze a suspicious GitHub repo and produce a risk level plus concrete red-flag reasons.

Frequently Asked Questions about identify-malicious-repository

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check if a GitHub repository is a malware scam?▼

To check if a GitHub repository is malware, analyze its metadata for piracy language, engagement anomalies, and brand impersonation to calculate a risk score and determine if it is a fraudulent distribution scam.

What are the red flags of a fake security software repository on GitHub?▼

Red flags of a fake security software repository include crack or keygen claims, inflated star counts without real engagement, missing README files, and branding that impersonates legitimate security products to distribute malware.

How do I detect brand impersonation in a suspicious GitHub repo?▼

Detect brand impersonation in a GitHub repo by extracting its metadata and comparing the repository name and description against legitimate security product branding to identify mismatches and calculate a risk level.

What should I do after accidentally downloading malware from a fraudulent repo?▼

After downloading malware from a fraudulent repo, follow defensive steps including reporting the repository, scanning your system for infections, and performing basic indicator of compromise checks to ensure cyber safety.

Can I use repository analysis to score the risk of pirated software links?▼

Yes, you can use repository analysis to score the risk of pirated software links by evaluating piracy language and suspicious engagement patterns to output a risk level and specific warnings.

Does this malicious repository detection method work without external dependencies?▼

Yes, this malicious repository detection method works without external dependencies, relying solely on extracting available repository metadata like description, star and fork counts, and README presence to generate a risk score.